Packet injection in a Wi-Fi network I have read some articles describing that one can use the monitor mode on a NIC to do packet injection. I really don't understand why I cannot just use the managed mode to forge the packets, and I can use another computer be a sniffer to sniff the packets. Recently I tried two experiments: 1. I tried to use Scapy to send the 802.11 probe response in managed mode. However, from the sniffer I cannot see the packets on the air. 2. If instead I send with the 802.11 QoS packet, then the sniffer shows the packets. What's the difference between these two cases? Is this because I don't use in monitor mode so I cannot send the probe response?

After doing some research on the internet:

I found some of the adapters can do TX when they are in monitor mode.

This is the reference, and from this reference I bought TP-LINK TL-WN722N.

<

And from the github open source, I found a really interesting project. Here is the link:

<

This is a Python project, and it can be simulated as an AP.

Follows the instructions on the git-hub, I successfully launch this fakeAP in the monitor mode. And from sniffer, I can found the beacon frame are sent from this fakeAP. The blue rectangle is the beacon frames, and the red rectangle is the SSID I specified in the program.

The following is the sniffer:

![enter image description here](

I also try with Managed mode, but the program launch fail. Hope this post will help anyone who are interested in this field.