title: capturing IEEE 802.11 packets without connecting to the network
body: <blockquote>
    <p>I want to analyze networks traffic but not by connecting it Just
    switch on wifi and sniff the packets (IEEE 802.11 Frames)
    in promiscuous mode </p>
  </blockquote>
  
  <p>I have tried libpcap but it may be internally changing datalinktype as i am giving wifi interface in </p>
  
  <pre><code>descr=pcap_open_live("en1", MAXBYTES2CAPTURE, 1, 512, errbuf);
  </code></pre>
  
  <p>(as we know mac OS x have en1 as wifi interface )                                             </p>
  
  <p>now when i do this                                                                                </p>
  
  <pre><code>printf("%s", pcap_datalink_val_to_name( pcap_datalink(descr)));
  </code></pre>
  
  <p>It gives me result <code>"ethernet"</code><br>
  I have tried to capture packets using wireshark without connecting to my wifi network and it worked!! 
  I was able to capture <code>Beacon , Acknowledgement and Authentication frames</code> without connecting to my wifi network.        </p>
  
  <p>now:                                                                                          </p>
  
  <ol>
  <li>do I have to make a network card driver for that or libpcap can do that ?if yes how?   </li>
  <li>Is wireshark making some kind of driver for that? if yes please help me to locate that  in it's source code.
  <ul>
  <li>I have tried Apple's CFNetwork but it too can't capture without connecting to the network.    </li>
  <li>It will be very helpful if i get some suggestion on some user space code as kernel level coding is a little tuff :( </li>
  </ul></li>
  </ol>
  
  <p>I am coding on MacOS 10.7 in xCode 4.5.1  </p>
  
  <p>Update:<br>
  I am already doing this:</p>
  
  <pre><code>descr=pcap_create("e1", errbuf);
  pcap_set_rfmon(descr, 0);
  pcap_set_promisc(descr, 0);
  pcap_activate(descr);    
  descr=pcap_open_live("en1", 2048, 1, 512, errbuf);                   
  </code></pre>
  
  <blockquote>
    <p>And yes there is a little monitor icon at the wifi and I can sniff the
    packets but only when I connect to the network, I want to do the same
    when I am not connected to wifi like capturing Beacon and
    Acknowledgment Frames means packets through which our network card detects available wifi network</p>
  </blockquote>