Working with wireless networks in the environment Kali Linux requires a special approach, especially if the main operating system is Windows or macOS. Virtualization via VirtualBox It provides a powerful testing tool, but creates a barrier to direct access to the physical hardware. The default settings allow network use only as a regular client, making it impossible to conduct security audits or intercept packets.
For full functionality of the pen tester, it is necessary to forward an external USB WiFi adapter inside the virtual machine. This will allow guest OS Gain full control over the device, bypassing host system restrictions. This process requires installing additional filters and properly configuring drivers, as VirtualBox isolates USB ports from the virtual environment by default.
Successful setup opens access to specialized utilities such as Aircrack-ng And WiresharkWithout forwarding the physical adapter, these tools will only see the virtual network interface, which doesn't support monitor mode. Below, we'll detail each step required to transform a simple USB dongle into a powerful traffic analysis tool.
It's important to understand that not all wireless modules are equally useful in Kali. Some chipsets have poor Linux support or don't support packet injection. Therefore, before beginning setup, make sure your device is based on a compatible controller, such as Atheros AR9271 or Ralink RT3070.
Preparing the host system and installing extensions
The first step is installation Oracle VM VirtualBox Extension PackWithout this package, forwarding USB 2.0 and 3.0 devices will not work, as the basic version of the program only supports USB 1.1 emulation. You can download the latest version from the developer's official website, making sure the version number matches your VirtualBox version.
After installing the package, you need to launch the Kali Linux virtual machine. In the emulator window menu, go to Devices → USBHere you'll see a list of available ports. If the list is empty or no devices are displayed, the extensions are not enabled or a reboot of the host system is required.
⚠️ Note: When installing the Extension Pack on Windows or macOS, you may be prompted for UAC confirmation or an administrator password. Without superuser privileges, USB drivers will not be able to take control of the device from the host OS.
The next step is to configure USB filters. In the virtual machine settings window (either before launch or on the fly via the menu), go to the section USB. Make sure the USB controller is enabled and the correct standard is selected (recommended USB 2.0 (EHCI) or USB 3.0 (xHCI) (Depending on the adapter). Click the add filter icon (green plus sign) and select your WiFi adapter from the list.
Creating a filter ensures that when a device is connected to the computer, VirtualBox will automatically "take" it from Windows/macOS and pass it on to Kali. The adapter should disappear from the host system's device list and appear as a new network connection within the guest OS.
☑️ Checking the environment readiness
Configuring a network interface in Kali Linux
After successfully forwarding the device to the virtual machine, you need to make sure the operating system recognizes it. Open a terminal in Kali and enter the command lsusbThe output should show your adapter along with its Vendor ID and Product ID. If the device isn't listed, check to see if the LED on the adapter itself is lit.
Next, check the presence of the network interface with the command ip link or ifconfig -aWireless interfaces in Kali are typically referred to as wlan0, wlan1 or have a prefix wlIf the interface appears but is marked as DOWN, it must be activated.
To activate, use the command:
sudo ip link set wlan0 upIf you plan to test the interface after enabling it, you'll need to switch it to the default (Managed) mode. However, before doing so, it's crucial to check whether your driver supports monitor mode. Not all Linux drivers support this feature, even if the hardware is capable of it.
Checking support for monitor mode and injections
The main purpose of connecting an adapter is to be able to intercept all traffic in the air, not just that addressed to your machine. Monitor mode is used for this purpose. The most convenient way to test support for this mode and the packet injection function is with a utility. airmon-ng.
Run the command:
sudo airmon-ngIn the results table, find your interface. The "PHY" column will show the number, and the "Driver" column will show the driver name. Pay special attention to the "Inject" column, which should contain yes. If there no, then it will be impossible to carry out attacks or penetration tests.
| Interface | Chipset | Driver | Injection support |
|---|---|---|---|
| wlan0 | Atheros AR9271 | ath9k_htc | Yes (Stable) |
| wlan0 | Ralink RT3070 | rt2800usb | Yes |
| wlan0 | Realtek RTL8812AU | rtl8812au | Yes (requires installation) |
| wlan0 | Intel Centrino | iwlwifi | Partially / No |
If the driver doesn't support the required features out of the box, manual installation of proprietary drivers or kernel patching may be required. For popular chipsets Realtek It is often necessary to compile modules separately, since their functionality is limited in the standard Kali repository.
To switch to monitor mode, use:
sudo airmon-ng start wlan0After running this command the interface name will change, usually a suffix is added mon (For example, wlan0mon). It is this new interface that is now ready for listening to the broadcast.
Why doesn't the monitor mode turn on?
System services such as NetworkManager or wpa_supplicant often interfere with the process. These services attempt to automatically connect to known networks, blocking access to low-level card management. Before starting airmon-ng, run the command: sudo airmon-ng check kill . This will forcefully stop the interfering processes.
Troubleshooting Realtek and other driver issues
The most common problem when working with WiFi in virtual machines is the lack of drivers for modern adapters, especially the series Realtek 8812AU or 8814AUStandard Linux kernel drivers often don't support monitor mode for these chips. In such cases, third-party repositories must be used.
The installation process is as follows. First, make sure the kernel headers and compiler are installed:
sudo apt update
sudo apt install -y linux-headers-$(uname -r) build-essential git
Then clone a repository with patched drivers (for example, from aircrack-ng or specialized forks for Kali):
git clone https://github.com/aircrack-ng/rtl8812au.gitcd rtl8812au
sudo./dkms-install.sh
After installation, you need to reboot the virtual machine or reconnect the USB device for the new module to load. Check via lsmod | grep 8812 should show the active module.
⚠️ Warning: When upgrading the Linux kernel in Kali (using the dist-upgrade command), manually installed drivers may stop working because the old kernel headers will be removed. After each major system update, you may need to repeat the driver compilation process.
If you have an adapter from MediaTek or old Ralink, they usually work fine with drivers mt76 And rt2x00 respectively, which are built into the kernel. Problems occur less frequently, but can be related to USB power conflicts.
Process conflicts and connection stability
Even with properly installed drivers, operation may be unstable due to background services. In Kali Linux, background services are running by default. NetworkManager, which aggressively scans networks and attempts to maintain a connection. This creates interference when scanning channels.
To temporarily disable interfering services, use the script built into the aircrack-ng package, as mentioned earlier. However, if you frequently work with wireless networks, it might make sense to configure systemd so that these services do not start automatically, or create an "Airmon" profile.
Another common issue is the adapter ceasing to function under heavy load. In a virtual environment, this may be due to insufficient USB bus resources or the host operating system's power saving settings. Ensure that the device auto-suspend option is disabled in the VirtualBox USB settings.
It's also worth checking the kernel logs for errors:
dmesg | grep -i usb"Deauthenticated" or "disassociated" messages may indicate not only attacks but also a poor signal or overheating of the adapter. When operating in monitor mode for an extended period, the USB connectors can become very hot, causing the connection to be lost.
Alternative methods and conclusions
If USB forwarding doesn't produce the desired results or causes system instability, it's worth considering alternatives. One option is to use an external WiFi card connected directly to the port but controlled via a network bridge, although this rarely provides monitor mode without forwarding.
Another option is to run Kali Linux in Live USB mode on physical hardware. This eliminates virtualization and USB driver issues, ensuring native performance. However, for many users, a virtual machine remains the preferred option due to the convenience of saving system state (snapshots).
In conclusion, connecting a WiFi adapter to Kali in VirtualBox is a fundamental skill for any cybersecurity professional. Despite possible driver complications Realtek or process conflicts, proper filter settings and understanding of how they work airmon-ng allow you to create a powerful testing lab on any computer.
Don't forget to regularly update your driver database and check the compatibility of new equipment before purchasing. The WiFi adapter market is constantly changing, and what worked a year ago may require some effort today.
Why doesn't VirtualBox see my USB WiFi adapter in the list of devices?
Most likely, you don't have the Extension Pack installed or activated. Also, check if the device is being used by another process on the host machine (for example, a router configuration program). Try reconnecting the adapter to a different USB port, preferably USB 2.0, if you're experiencing compatibility issues.
Is it possible to use a laptop's built-in WiFi for Kali in VirtualBox?
Theoretically, yes, if you route the internal USB module through filters. However, this is risky: you can lose connection to the host system during the process, especially if you're using WiFi for internet access. Furthermore, internal cards' antennas are often weaker, and drivers (especially Broadcom or Intel) may not support monitor mode.
What is the best adapter to buy for a beginner penetration tester?
Adapters based on the Atheros AR9271 chip remain the gold standard. They're inexpensive, have excellent Linux support out of the box, and work reliably in monitor mode. For more advanced tasks (5 GHz, long distances), consider adapters based on the Realtek RTL8812AU chip, but be prepared to tinker with driver installation.
Does Kali require internet access for the WiFi adapter to work after setup?
Internet access is not required for packet interception and monitoring. However, if you plan to update databases (for example, for wifite or hashcat) or install missing drivers during operation, a network connection (via a virtual NAT Ethernet interface) will be required in parallel with the USB adapter.