So, I think when I run Wireshark the wireless card works using promiscuous mode because if it is managed mode the wireless card will capture only packages directed to its. Monitor mode also cannot be used by default. Is it so?
1 Answer
You really should read WLAN (IEEE 802.11) capture setup which discusses this extensively.
So, I think when I run Wireshark the wireless card works using promiscuous mode
You can check the box, but it probably doesn't do much. Promiscuous mode is, in theory, possible on many 802.11 adapters, but often does not work in practice; if you specify promiscuous mode, the attempt to enable promiscuous mode may fail, the adapter might only capture traffic to and from your machine, or the adapter might not capture any packets.
Monitor mode also cannot be used by default.
It's not the default, certainly. You may have to perform operating-system-dependent and adapter-type-dependent operations to enable monitor mode. It's generally not available on Windows because Monitor mode is not supported by WinPcap, and thus not by Wireshark or TShark, on Windows. (Use of npcap may enable it).
Is it so?
Yes. Without any interaction, capturing on WLAN's may capture only user data packets with "fake" Ethernet headers. In this case, you won't see any 802.11 management or control packets at all, and the 802.11 packet headers are "translated" by the network driver to "fake" Ethernet packet headers. In other words, sniffing wireless will generally look just like sniffing a wired interface in non-promiscuous mode.
