title: Monitor Mode on Mac - with Scapy
body: <p>I am trying to understand what happens when I put on mac in monitor mode. Without the monitor mode, using ifconfig, I find that 'en0' is the active interface. However, in monitor mode, this is what I get:</p>
  
  <pre><code>lo0: flags=8049&lt;UP,LOOPBACK,RUNNING,MULTICAST&gt; mtu 16384
      options=3&lt;RXCSUM,TXCSUM&gt;
      inet6 ::1 prefixlen 128 
      inet 127.0.0.1 netmask 0xff000000 
      inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
      nd6 options=1&lt;PERFORMNUD&gt;
  gif0: flags=8010&lt;POINTOPOINT,MULTICAST&gt; mtu 1280
  stf0: flags=0&lt;&gt; mtu 1280
  en0: flags=8963&lt;UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST&gt; mtu 1500
      ether 70:56:81:b9:43:e5 
      nd6 options=1&lt;PERFORMNUD&gt;
      media: autoselect (&lt;unknown type&gt;)
      status: inactive
  en1: flags=963&lt;UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX&gt; mtu 1500
      options=60&lt;TSO4,TSO6&gt;
      ether 32:00:1a:7f:0a:40 
      media: autoselect &lt;full-duplex&gt;
      status: inactive
  p2p0: flags=8843&lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&gt; mtu 2304
      ether 02:56:81:b9:43:e5 
      media: autoselect
      status: inactive
  awdl0: flags=8902&lt;BROADCAST,PROMISC,SIMPLEX,MULTICAST&gt; mtu 1484
      ether ee:85:08:e0:ba:17 
      nd6 options=1&lt;PERFORMNUD&gt;
      media: autoselect
      status: inactive
  bridge0: flags=8863&lt;UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST&gt; mtu 1500
      options=63&lt;RXCSUM,TXCSUM,TSO4,TSO6&gt;
      ether 72:56:81:9b:d1:00 
      Configuration:
          id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
          maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
          root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
          ipfilter disabled flags 0x2
      member: en1 flags=3&lt;LEARNING,DISCOVER&gt;
              ifmaxaddr 0 port 5 priority 0 path cost 0
      nd6 options=1&lt;PERFORMNUD&gt;
      media: &lt;unknown type&gt;
      status: inactive
  </code></pre>
  
  <p>I am trying to use scapy for sniffing wireless network. So, when I run scapy, it shows iface as 'lo0' and it does not capture any packet. I have looked at a lot of answers regarding this, but most of them are for ubuntu and say that when you put your system in monitor mode, you get 'mon0' interface and then pass this to your scapy and sniff. But in mac, I am not getting anything like the 'mon0', in fact all the interfaces goes inactive in monitor mode. Could some one please help me understand what is happening?</p>
  
  <p>PS: WireShark and Tcpdump work just fine in monitor mode and scapy too captures frames when not in monitor mode. But I am interested in management frames, so I need scapy to capture those on monitor mode. TIA:)</p>