A laptop on the same Wi-Fi as an IoT device runs Wireshark. Which of the device's packets can it actually capture?
In normal (managed) mode, only traffic to or from the laptop itself, plus broadcast and multicast. To see frames between other stations it has to switch the card into monitor mode. On an open network those frames are then readable; with WPA2/3 they are encrypted.
A Wi-Fi card in its normal mode delivers only frames addressed to it. Everything else is in the air but is dropped by the hardware. So what a sniffing laptop sees depends on where it sits:
| Situation | What the laptop captures |
|---|---|
| The device talks to the laptop (the laptop runs the server) | All of it. Packets addressed to you are always captured |
| The device talks to another host, laptop in managed mode | Nothing of that conversation, only broadcast/multicast such as ARP or mDNS |
| Same, laptop in monitor mode | Every frame on the channel. Readable if the network is open, encrypted if it uses WPA2/WPA3 |
Monitor mode is a property of the card and driver. Not every adapter supports it, and on Linux it is enabled with tools such as iw or airmon-ng.
Link-layer encryption changes the picture only partly. WPA2/3 hides the payload from outsiders, but on a WPA2-Personal network anyone who knows the shared password and captures a device's connection handshake can decrypt that device's traffic. That is why sensitive commands also need encryption end to end (TLS) and not only on the Wi-Fi link.
Go deeper:
Wireshark wiki — WLAN capture setup — managed vs monitor mode, and decrypting WPA traffic.- Wikipedia — Monitor mode — what it is and how it differs from promiscuous mode.