image.png
查阅资料后发现，当无线网卡不支持或者没有设置为monitor mode时，无线网卡的驱动会自动把802.11 frame 转化为Ethernet frame后给kernel。官方解释为：
If you‘re trying to capture network traffic that‘s not being sent to or from
the machine running Wireshark or TShark, i.e. traffic between two or more
other machines on an Ethernet segment, or are interested in 802.11 management
or control packets, or are interested in radio-layer information about
packets, you will probably have to capture in "monitor mode". This is
discussed below.
Without any interaction, capturing on WLAN‘s may capture only user data
packets with "fake" Ethernet headers. In this case, you won‘t see any 802.11
management or control packets at all, and the 802.11 packet headers
are"translated" by the network driver to "fake" Ethernet packet headers.
2017-11-27 16_45_50 _______________.png
此时无线网卡的模式为managed。因此，我试着去打开无线网卡的monitor mode。查阅资料后，使用命令：
sudo ifconfig wlan11 down
sudo iwconfig wlan11 mode monitor
sudo ifconfig wlan11 up
2017-11-27 16_45_28 _______________.png
此时，网卡的模式已经变为Monitor，在使用wireshark进行抓包，发现也有了radiotap header：
2017-11-27 16_45_01 _______________.png
参考网址：
https://www.zhihu.com/question/30085207
http://blog.csdn.net/qq_28057541/article/details/52937742
http://www.lxway.com/425268056.htm
