tcpdump -i mlan0 -ntcpdump: verbose output suppressed, use -v or -vv for full protocol  decode listening on mlan0, link-type EN10MB (Ethernet), capture size  262144 bytes  Why is this Ethernet here? I am using wifi, not an Ethernet.decode listening on mlan0, link-type EN10MB (Ethernet), capture size   262144 bytes I'm not sure how I can research this. I can find man pages on tcpdump usage. But nothing to explain this particular line.
Itcpdump output - why is it showing an Ethernet status?
wifi;tcp;ethernet;tcpdump;wlan
Why is this Ethernet here? I am using wifi, not an Ethernet.Because you're not capturing in monitor mode; on most operating systems, the only way to get 802.11 headers, rather than fake Ethernet headers, on a Wi-Fi capture is to capture in monitor mode.  This includes Linux, OS X, and Windows (although WinPcap doesn't currently support monitor mode).If you only want to see traffic to and from your machine, you can capture without monitor mode.  You won't see packets other than data packets.If you want to see other traffic on your network, or want to see non-data packets, or want to see 802.11 headers, or want to see 802.11 headers and radio information (data rate, signal strength, etc.), you need to capture in monitor mode.  However, in monitor mode, packets on a protected network (network using WEP or WPA/WPA2) will not be decrypted; Wireshark can decrypt them if you supply the network's password and, if the network uses WPA/WPA2, if you've captured the initial EAPOL handshakes for each device whose traffic you want to decrypt.