Because a wireless adapter will always get '802.11 plus radiotap header' using Npcap. IEEE802_11_RADIO_AVS (802.11 plus AVS radio information header) No, it's returned from pcap_list_datalinks(), which can return multiple values - and does for example, on my Mac:ĭata link types for en0 when not in monitor mode (use option -y to set):ĭata link types for en0 when in monitor mode (use option -y to set): It seems that the link-layer header type can be multiple (a list)? Why this? I thought this value is obtained from the pcap_datalink() function,

> causes problems trying to use monitor mode in the Qt interface. > I see you figured out that you need to use the GTK+ version if you want to be able to turn monitor mode on.

> 1) For GUI, if you check the 'Capture packets in monitor mode' option in 'Edit Interface Settings', your adapter will turn into monitor mode immediately.

> This version Npcap already supports monitor mode setting using Wireshark GUI or command line. On May 20, 2016, at 6:46 PM, Yang Luo wrote:

Wireshark monitor mode windows