When I use Wireshark to capture traffics with my wlan card with monitor mode already set, it only displays 802.11 frames. However, if I use Wireshark with managed mode wlan(promiscuous mode), it certainly displays 802.3 frames.
I searched for some related information and found out that 'network bridging' allows devices to convert 802.11 wireless packets to 802.3 packets. In case of packet capturing, pcap allows conversion.
(link: How to real time convert wireless packet(802.11) to Ethernet packet(802.3) in windows?)
So, Why is 802.11 to 802.3 frame conversion impossible when using monitor mode(not associated to the wireless network)?
Below are pictures of the situation. Thank you in advance.
For one thing, not all 802.11 packets have Ethernet equivalents; only data packets do. In monitor mode, in addition to data packets, control and management packets can be captured - you're seeing those types of packets in your monitor-mode capture.
For another thing, when capturing in monitor mode on a "protected" network (WEP, WPA), data packets are encrypted (to protect them from being sniffed), and can't be converted to Ethernet packets until they're decrypted. Under some circumstances, Wireshark can decrypt them, but Wireshark doesn't do any conversion from 802.11 to 802.3 in any circumstances - when not capturing in monitor mode, the 802.11 adapter converts data packets to 802.3 packets after decrypting them, and doesn't show non-data packets to the host.
