Switching to standard monitoring mode Monitoring is a fundamental step for any information security professional planning a wireless network audit. Unlike standard operation, where the network card filters frames and only accepts packets addressed to it, monitoring allows for the capture of all traffic. This allows for analyzing the network structure, detecting hidden SSIDs, and assessing the true security of the perimeter.
The process of activating this feature in the distribution Kali Linux This may seem simple, but in practice, users often encounter driver blockages or system process conflicts. The success of the operation directly depends on the compatibility of your USB adapter's chipset and the correct execution of the command sequence. Errors at this stage can lead to the false conclusion that the tool is not working, when in fact the problem lies in the software.
In this guide, we'll detail the mechanics of wireless interfaces and provide proven action algorithms. You'll learn not only how to enable the required mode but also how to diagnose problems if standard methods fail. A thorough understanding of the processes occurring at the kernel level will allow you to effectively use auditing tools in any environment.
Selecting compatible hardware and checking drivers
The foundation of successful work is the correct choice of hardware. Not every Wi-Fi adapter can support the advanced features required for pentesting. Most modules built into laptops have limited functionality and don't allow for on-the-fly mode switching. For professional work, an external device with injection and monitoring support is essential.
The most stable work in the environment Linux traditionally demonstrate chipsets from the company Atheros, as well as some models based on RealtekWhen purchasing equipment, it's important to pay attention not to the brand of the plastic case, but to the internal components. Popular models like Alfa Network are often based on proven chips, which guarantees compatibility with the software's utilities. aircrack-ng.
⚠️ Note: Many modern USB 3.0 adapters may experience stability issues when capturing packets due to interference. For initial training and use, we recommend using USB 2.0 devices.
Before you begin, make sure the system recognizes your device. In the terminal, run the command lsusb, which will display a list of connected USB devices. Find your adapter in the list and note its Vendor and Product IDs. If the device shows as "Unknown" or doesn't appear at all, check the connection or try a different port.
Kali uses a subsystem to manage drivers. mac80211This is what allows you to programmatically switch the interface state. If your adapter uses proprietary drivers (for example, Broadcom or some versions of Realtek), you may not be able to switch it to the desired mode using standard tools. In such cases, compiling drivers from source code or replacing the kernel module is often required.
Diagnostics of the current interface state
Before making any changes to your network configuration, you need to get a complete picture of the current system state. Standard tools like ifconfig may hide important details, so a utility is used for deep diagnostics iwIt interacts directly with the device driver and provides detailed information about the supported functions.
Enter the command in the terminal iw listThe output will be lengthy, so scroll down to the "Supported interface modes" section. There should be an item there monitorIf this word is not listed, it means your driver or hardware does not support the required functionality, and further actions will be useless.
iw devTeam iw dev will show the name of your interface (usually wlan0 or wlx...) and its current type. It is also useful to perform ip link showto see if the interface is administratively blocked. If you see the status NO-CARRIER or no link, this is normal for monitoring mode before scanning starts, but the interface must be active (UP).
| Team | Purpose | Key parameter |
|---|---|---|
iw list |
Information about driver capabilities | Supported interface modes |
iw dev |
List of active interfaces | Interface name |
ip link |
Link status and MAC address | state UP/DOWN |
rfkill list |
Checking software blockages | Soft blocked |
A common issue is software blocking of the wireless module. The system may block the adapter to save power or due to a conflict with other services. Command rfkill list all will clearly show the blocking status. If the "Soft blocked" column reads "yes," you need to remove the blocking with the command rfkill unblock wifi.
Using the Airmon-ng utility for automation
The most popular and simple way to switch the card to the desired mode is to use a script airmon-ng, included in the package aircrack-ng. This tool automates the process of disabling interfering processes and changing the driver's operating mode. It's ideal for novice users and situations where quick results are required.
To get started, run a system check with the command airmon-ng checkThe script will scan for running processes that may be using the wireless interface, such as NetworkManager, wpa_supplicant, or dhclient. The presence of these processes often leads to errors when launching scanners, so they should be terminated.
sudo airmon-ng check killAfter clearing the processes, you can initiate monitoring. Enter the name of your interface, which you learned earlier through iw devUsually the command looks like this sudo airmon-ng start wlan0If the operation is successful, the system will create a new virtual interface, often called wlan0mon.
☑️ Preparing to launch airmon-ng
It is important to understand that creating a new interface wlan0mon means that the old one wlan0 has been temporarily deactivated or changed. All further scanning and traffic analysis must be performed under the new name. The old interface will not be accessible for regular internet connections at this time.
⚠️ Warning: After running airmon-ng in kill mode, you may lose internet access. To restore normal network operation, you must reboot your computer or manually restart the NetworkManager service.
Manual configuration via the Iw and Ifconfig utility
For those who prefer full control over the system or have encountered errors with automated scripts, there's a manual method. It relies on standard interface management utilities and doesn't rely on third-party add-ons. This approach requires precision but provides insight into the internal processes.
The first step is to force-down the interface to change its settings. Use the command sudo ifconfig wlan0 down or more modern sudo ip link set wlan0 downWithout this step, the driver will not allow you to change the operating mode, since the device is busy.
sudo iw dev wlan0 set type monitorAfter executing the type installation command, the interface needs to be brought up again. Run sudo ifconfig wlan0 upThe adapter is now in listening mode. You can check the results via iwconfig, where the Mode line should indicate Monitor.
What to do if the interface does not start?
If the interface doesn't activate after the 'up' command, try changing the command order or checking the kernel logs (dmesg) for driver errors. Sometimes, forcibly removing the kernel module (rmmod) and reloading it (modprobe) helps.
The advantage of the manual method is that it doesn't create new virtual interface names, but rather changes the state of the current one. This can be convenient when writing your own automation scripts. However, if background processes like NetworkManager attempt to reestablish the connection, they may disrupt your settings.
Resolving Conflicts with NetworkManager
One of the most annoying issues in Kali Linux is the aggressive behavior of the service NetworkManagerIt's designed to conveniently connect to Wi-Fi in a graphical interface, but in security audit mode, it becomes an enemy. The service constantly attempts to manage the adapter, resetting monitoring settings and restoring the normal connection.
If you notice that after starting monitoring, the interface reverts to Managed mode after a few seconds, you need to stop the service. This is done with the command sudo systemctl stop NetworkManagerIn some cases, you may also need to disable its autoload if you plan to use the system only for penetration testing.
An alternative to stopping the service completely is to use a configuration file. Create the file in the directory /etc/NetworkManager/conf.d/ with a rule to ignore your external adapter. This will allow you to use the internet via the built-in card or Ethernet while the external adapter is completely under your control.
Please note that after stopping the network service, you will no longer be able to connect to access points via the graphical interface. To return to normal operation, you will need to restart the service using the command sudo systemctl start NetworkManagerThis is standard behavior and not a system error.
Common mistakes and solutions
Even if all instructions are followed, specific errors may occur depending on the kernel version or specific chipset revision. For example, the "Device or resource busy" error indicates that a process is already using the interface. In this case, re-running the command will help. airmon-ng check kill or manual search for the process through lsof.
Another common error is "Operation not permitted." This almost always indicates insufficient privileges. Make sure you run commands as root, using the prefix sudoWithout root privileges, changing the network card operating mode is impossible for kernel security reasons.
| Error | Probable cause | Solution |
|---|---|---|
| Device busy | The interface is busy with a process | airmon-ng check kill |
| Operation not permitted | Root rights are missing | Use sudo |
| No such device | The adapter is disconnected or burned out | Check lsusb / physical connection |
| Invalid argument | The driver does not support the mode | Replacing the adapter or driver |
If the adapter disappears from the list lsusb After attempting to start monitoring, this may indicate a power shortage. USB ports don't always provide sufficient current for high-power cards with antennas. Try using a powered USB hub or connecting the adapter to the port on the back of the system unit.
If the standard drivers don't work, it's worth searching for alternative versions in GitHub repositories. The developer community often creates patches for new chipsets that haven't yet made it into the mainline Linux kernel. Installing these drivers requires some compiling skills, but they can revive an unsupported device.
Terminate session and restore network
After finishing working with wireless traffic, it's crucial to restore the system to its original state. Leaving the interface in monitor mode will prevent you from connecting to a regular access point for internet access. Furthermore, virtual interfaces can interfere with normal network operation during the next reboot.
For proper termination use the command sudo airmon-ng stop wlan0mon (or the name of your monitoring interface). This will remove the virtual interface and return the physical adapter to standard mode. Afterwards, be sure to restart the network service: sudo systemctl start NetworkManager.
If you used the manual method through iw, then the sequence will be reversed: omit the interface, change the type to managed and lift it. Check through iwconfig should show the mode Managed, which indicates readiness for normal use.
Why doesn't my adapter see 5 GHz networks in monitor mode?
Many budget adapters only support monitoring in the 2.4 GHz band. 5 GHz requires a dual-band chipset and the appropriate channel setting using the iw command before starting scanning.
Is it possible to work in monitoring mode without root rights?
No, changing the network interface mode is a low-level operation that requires hardware access. Without superuser (root) privileges, the Linux kernel will block any attempt to change the mode.
Does monitoring mode affect internet speed?
In monitoring mode, the adapter doesn't connect to the access point for data transfer; it only listens to the broadcast. Therefore, the internet won't work through this specific adapter. If you only have one adapter, the internet will be completely lost.