Wi-Fi Monitoring Mode in Kali Linux: A Complete Guide for Beginners and Pros

Converting the Wi-Fi adapter to monitoring mode (monitor mode) is a key step for analyzing wireless networks, testing security or searching for vulnerabilities. Kali Linux This process requires not only knowledge of commands but also an understanding of hardware limitations: not all adapters support this mode, and some require additional drivers. Without proper configuration, you risk errors like SIOCSIFMODE: Operation not permitted or Device or resource busy, which block further work.

This article will help you figure out how put the adapter into monitoring mode without failures, even if you are new to Kali LinuxWe'll cover selecting compatible hardware, installing drivers, basic commands for activating the mode, and troubleshooting common issues. Particular attention will be paid to chip-based adapters. Atheros, Ralink And Realtek, which are most often used for auditing Wi-Fi networks.

1. Which Wi-Fi adapters support monitoring mode?

Not every Wi-Fi adapter can operate in monitoring mode. The main criterion is support. batch injection and the ability to switch to monitor mode at the driver level. Most built-in laptop adapters (e.g. Intel AX200 or Broadcom BCM43xx) block this function at the software level.

For stable operation, external USB adapters with chips are recommended:

• 🔹 Atheros AR9271 (For example, TP-Link TL-WN722N v1 or Alfa AWUS036NHA) is the best choice for beginners;
• 🔹 Ralink RT3070/RT3572 (Alfa AWUS036NEH, TP-Link TL-WN822N v4);
• 🔹 Realtek RTL8187/RTL8812AU (Alfa AWUS036ACH), but require manual installation of drivers;
• 🔹 Broadcom BCM43xx (rarely, only with patched drivers).

⚠️ Attention: Chip adapters Realtek RTL8188EU (For example, TP-Link TL-WN725N v2/v3) often don't support monitoring mode without kernel modification. Check the chip version before purchasing!

To find out the model of your adapter, run the command:

lsusb

Or for embedded devices:

lspci | grep -i network

2. Checking the current adapter mode and installing drivers

Before activating the monitoring mode, make sure that the adapter is recognized by the system and is not busy with other processes (for example, NetworkManager or wpa_supplicant). To do this:

1. Disable all network services:

   sudo systemctl stop NetworkManager
   sudo systemctl stop wpa_supplicant

2. Check the current adapter mode:

   iwconfig

   Look for the line Mode:Managed - This is the standard connection mode.

3. Make sure the adapter is not blocked:

   rfkill list

   If the status Soft blocked: yes, unlock it:

   sudo rfkill unblock wifi

If the adapter is not detected or is unstable, you will need to install drivers. For chips Atheros And Ralink they are usually already included in the kernel Kali Linux, but for Realtek RTL8812AU you will have to compile manually:

sudo apt update
sudo apt install -y realtek-rtl88xxau-dkms

Disable NetworkManager and wpa_supplicant|

Checking the current mode via iwconfig|

Unblock adapter (rfkill unblock)|

Installing drivers (if required)-->

3. Activating monitoring mode: step-by-step instructions

When the adapter is ready, put it into monitoring mode using the utility airmon-ng (included in the package) aircrack-ng). Follow the instructions:

1. Install aircrack-ng, if it is not installed:

   sudo apt install aircrack-ng

2. Launch airmon-ng To check available adapters:

   sudo airmon-ng

   Find your adapter in the list (for example, wlan0).

3. Kill interfering processes (if any):

   sudo airmon-ng check kill

4. Activate monitoring mode:

   sudo airmon-ng start wlan0

   After successful execution, the adapter will receive a new name (for example, wlan0mon).

Check the result with the command:

iwconfig

The output should show Mode:Monitor.

sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

4. Common mistakes and their solutions

Even if you're following the correct steps, you may encounter errors. Let's look at the most common ones:

If the adapter stops working after switching to monitoring mode, return it to its original state:

sudo airmon-ng stop wlan0mon

sudo apt purge realtek-rtl88xxau-dkms
sudo apt install realtek-rtl88xxau-dkms

5. Checking the functionality of the monitoring mode

To ensure that the adapter is working correctly in monitor mode, run a scan of nearby networks using airodump-ng:

sudo airodump-ng wlan0mon

A table with detected access points (APs) and client devices should appear in the terminal. If the list is empty:

• 🔄 Check that the adapter is in monitoring mode (iwconfig);
• 📶 Make sure there are active Wi-Fi networks nearby;
• 🔌 Try a different USB port or extension cable (some adapters are sensitive to interference).

If airodump-ng It shows networks but doesn't receive a handshake. The problem may be with the driver. For chips Realtek try adding the parameter -c with channel number:

sudo airodump-ng wlan0mon -c 6

6. Security and legal aspects of using the monitoring mode

The monitoring regime itself is not illegal, but its use for traffic interception or network hacking without the owner's permission violates the laws of most countries (including the Russian Federation, the EU, and the US). According to the article Article 272 of the Criminal Code of the Russian Federation ("Unauthorized access to computer information"), unauthorized access to other people's networks is punishable by a fine of up to 200,000 rubles or imprisonment.

Legal use cases:

• 🔒 Testing his own networks for vulnerabilities;
• 📡 Search for sources of interference on the air;
• 🛠️ Diagnosing connection problems (for example, detecting Wi-Fi jammers).

⚠️ Attention: Even scanning other people's networks without attempting to connect can be considered preparation for an attack. Always obtain written permission from the network owner before testing.

For a legal audit, use tools like Kismet or Wireshark with filtering by MAC addresses of your devices. An example of a secure startup Wireshark:

sudo wireshark -k -i wlan0mon -f "wlan addr1 xx:xx:xx:xx:xx:xx"

Where xx:xx:xx:xx:xx:xx — The MAC address of your router.

7. Alternative tools for working in monitoring mode

Besides airodump-ng, V Kali Linux There are other utilities for analyzing Wi-Fi networks:

It is convenient to use for visualization of networks Wavemon — console analyzer with a text interface:

sudo apt install wavemon
sudo wavemon

Frequently Asked Questions (FAQ)

sudo airmon-ng stop wlan0mon

sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up