A help desk asks whether enabling monitor mode by itself decrypts WPA2 traffic for a municipal investigation. What is accurate?
Select an answer to reveal the explanation.
Short Explanation
Monitor mode is like putting a radio in “listen to everything”—you hear the encrypted chatter, not the clear conversation, until you have the keys. Capture is not decryption. WPA2 still needs the right cryptographic material and analysis context.
Full Explanation
Monitor mode allows an adapter to receive 802.11 frames without associating as a normal client. Encrypted WPA2 payloads remain encrypted until keys and sufficient handshake or session context are available for analysis. Confusing capture capability with decryption leads to incorrect investigative expectations.