How to put Mac OS X wireless adapter in monitor mode

What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. It's a binary command, which I've symlinked into /usr/local/bin/ for convenience.

Creating Symlink:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport

Example of sniffing in monitor mode:

sudo airport en1 sniff 1

This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap (where XXXXXX will vary). You can view this with tcpdump -r <filename> or by opening it in wireshark.

To search for active channels nearby that you can sniff, run this:

sudo airport en1 -s

Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.

You can also do it via the GUI if that is easier for you.

In Mavericks:

• Search Spotlight (Command+Space) for "Wireless Diagnostics"
• When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
• Click on the Frame Capture Tab
• Rename the output .wcap file to .pcap for use with Eye P.A.

Pass the -I flag to tcpdump or tshark (wireshark command-line utility).

For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':

tcpdump -Ini en0 -w save.pcap

Or to examine probe request 802.11 management frames live:

tshark -Ini en0 -s 256 type mgt subtype probe-req

Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:

sudo chmod 0644 /dev/bpf*