How to Put a WiFi Card into Monitor Mode: A Complete Guide

Switching to monitor mode is a fundamental step for any information security professional planning to analyze wireless networks. Unlike standard mode, when the network card filters packets and only accepts those addressed to your device, monitor mode monitoring Allows you to capture absolutely all air traffic. This makes it possible to see hidden SSIDs and passwords (if vulnerabilities are present), and analyze the structure of neighboring networks.

Many beginners encounter the problem that the standard operating system drivers do not allow enabling this mode through the graphical interface. This usually requires the use of specialized distributions, such as Kali Linux or Parrot Security OS, and work via the terminal. It's important to understand that not every device can support this feature, as it depends on the hardware chipset and driver quality.

In this article, we'll cover the process of selecting hardware, installing the necessary utilities, and actually setting the adapter to the desired mode. You'll learn how to bypass limitations of standard drivers and which commands to use to verify the operation's success. We'll also cover common errors that occur when attempting to capture packets.

Selecting compatible hardware and chipsets

The most critical step is choosing the right WiFi adapter. Most modules built into laptops, as well as cheap USB dongles with chips, Realtek or MediaTek often lack injection support or a full-fledged monitoring mode. For successful operation, you'll need a device based on chipsets from Atheros (Qualcomm), Ralink or specific series Realtek, such as RTL8812AU.

Manufacturers often hide information about monitoring support, so it's worth checking out reviews from the pentesting community before purchasing. Adapters with an external antenna typically provide better signal reception, which is critical for long-range network scanning. Internal Mini PCIe or M.2 cards may also work, but require proper driver configuration in Linux.

There is a common misconception that data transfer speed (AC, AX) is more important than support for security protocols. However, for a security audit, stability in injection mode is more important than maximum file download speed. Older models based on Atheros AR9271 are still considered the benchmark for training, despite only supporting the 802.11n standard.

Preparing the operating system and drivers

Linux is the optimal environment for working with wireless interfaces. Windows has significant kernel-level limitations that prevent network cards from fully functioning in monitoring mode without complex workarounds. Therefore, installation Kali Linux to a virtual machine or a second hard drive partition is standard practice.

Before you start any manipulations, you need to make sure that you have the latest versions of utilities installed. aircrack-ngThis package contains all the necessary tools for managing wireless interfaces. On Debian-based systems, they can be installed through the package manager by running the update repositories command.

sudo apt-get update
sudo apt-get install aircrack-ng

Conflicts often arise with network managers such as NetworkManager or wpa_supplicantThese services attempt to automatically connect to available access points and block the device from entering monitoring mode. Before running a scan, you should temporarily disable them to gain full control of the device.

⚠️ Attention: If you're using a virtual machine (VirtualBox, VMware), make sure the USB controller is configured for version 2.0 or 3.0 and redirect the device within the guest OS. Otherwise, the system will see the adapter only as a storage device or not at all.

Network interface identification

After connecting the adapter, the first step is to determine its name in the system. In Linux, interface names may differ from the familiar "wlan0" and often change depending on the kernel configuration. To list all network devices, use the command ip link or a specialized utility iwconfig.

Pay attention to the interface status. If it is in the "UP" state, it must be switched to the "DOWN" state before changing the operating mode. This is a mandatory requirement for most drivers. Ignoring this step will result in a "Device or resource busy" error.

ip link show

In the list, look for a device that has no physical connection (usually your WiFi adapter if your Ethernet cable is connected). Remember its name, for example, wlan0 or wlx00c0ca...We'll use this name in all commands from now on. If the adapter isn't visible, check its connection in the virtual machine menu or try a different USB port.

Putting the adapter into monitoring mode

There are two main ways to switch the mode: through the utility airmon-ng and through a standard tool iwThe first method is more automated and often resolves conflicting processes automatically. The second method provides a lower level of control and is suitable for fine-tuning.

Let's consider the method using airmon-ngThis utility not only changes the mode but also creates a virtual interface for monitoring. The command requires the name of your physical interface. After running the command, the interface name often changes, adding the "mon" suffix.

sudo airmon-ng start wlan0

If you prefer manual control, you can use a sequence of commands ip And iwFirst, turn off the interface, change the type to "monitor," and turn it back on. This method is useful if automatic scripts aren't working correctly or are causing the driver to freeze.

sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

A successful transition is confirmed by a change in the interface type in the command output. iwconfigInstead of "Managed" or "Auto," it should say "Monitor." Also, pay attention to the frequency and channel, which may be set by default. To scan all networks, it's best to leave the settings on automatic or select the busiest channel.

⚠️ Attention: When using the command airmon-ng check kill The system will forcefully terminate processes that are interfering with your work. Save all open documents, as this may close active network connections and programs.

What should I do if the interface does not return to normal mode?

If the adapter remains in monitor mode after shutdown, use the command "sudo airmon-ng stop wlan0mon" or manually change the type to "managed" using iw. Restarting the computer also resets the driver settings.

Checking the operation and capturing packets

After switching to monitoring mode, you need to make sure that the adapter is actually "hearing" the air. This is done using a utility. airodump-ngIt displays a list of all available access points and clients in real time. If the list is empty, check the distance to the routers or try changing the channel.

To start a scan, specify the monitoring interface. The utility will display a table with SSIDs, MAC addresses, signal strength (PWR), and packet counts. A high PWR value (close to 0, for example -20) indicates the proximity of the signal source, while values ​​below -90 indicate a very weak signal.

sudo airodump-ng wlan0mon

For deeper analysis, you can filter the scan by a specific channel. This reduces noise and allows you to focus on the target network. It's also useful to run a log capture for later analysis of passwords or handshakes.

Table of popular chipsets and their compatibility

Not all adapters work equally well with auditing tools. Below is a comparison table of popular chipsets to help you evaluate the capabilities of your hardware or choose a new one.

As you can see from the table, the chipsets Atheros And Ralink have better support out of the box. For modern adapters on Realtek Drivers often require manual compilation from source code, which can be challenging for beginners. However, they provide significantly higher speeds and support for the 5 GHz band.

Fixed bugs and issues

One of the most common problems is the "failed to set channel" or "device busy" error. This means that some process is still holding control of the adapter. In such cases, the following command can help: airmon-ng check kill, which forcibly releases the interface. It's also worth checking if wpa_supplicant in the background.

Another common issue is that the adapter disappears from the system after enabling monitoring mode. This often indicates driver instability or insufficient power to the USB port. Try connecting the device through a powered USB hub or a USB 3.0 port.

⚠️ Attention: Interfaces and methods for managing network settings may vary across different Linux distributions. If the commands don't work, check your distribution's official documentation or update the package. aircrack-ng.

If all else fails, try using a Kali Linux Live USB image. Working from a live USB drive eliminates conflicts with the drivers and settings installed in the main system. This is the cleanest way to test the functionality of your hardware.

Is it possible to put a laptop's built-in card into monitoring mode?

Theoretically, it's possible if the chipset supports this feature and Linux drivers are available. However, in practice, integrated cards (especially Intel and Broadcom) often have limited functionality and don't work well with packet injection. For serious work, an external USB adapter is better.

Does monitoring mode affect internet speed?

Yes, while the adapter is in monitor mode, it can't connect to the internet like a regular client device. It only listens to the broadcast. To connect to the internet, you need to stop monitoring mode and return the interface to "managed" mode.

Do I need special privileges (root) to run commands?

Absolutely necessary. Low-level management of network equipment requires superuser privileges. All commands in this article must be run with the - prefix. sudo or from under the root user.

Does this work on Windows?

Natively, no. Windows drivers don't provide an API for full monitoring mode. You can use emulators like Cygwin with patched drivers or run Linux in a virtual machine, passing the USB adapter through to the guest OS.