How to Enable WiFi in Kali Linux After Airmon-ng

After completing a wireless security audit or penetration testing in Kali Linux, users often encounter an unpleasant situation: the internet connection is lost, and the network icon in the upper right corner disappears. This is standard system behavior when the interface is put into monitor using the utility airmon-ngIn this mode, the network adapter stops functioning as a regular client and begins passively listening to the air, making it impossible to connect to the access point.

To restore normal operation, you need to reverse the procedure: disable monitor mode and restart the network manager. The process is not difficult, but it requires careful entry of commands in the terminal, as interface names may vary depending on your hardware. Users often forget to stop background processes, which leads to conflicts and the inability to launch regular Wi-Fi.

In this article, we'll detail the steps to restore the connection. We'll cover manual control via the terminal, working with the graphical interface, and troubleshooting common errors that occur when attempting to switch operating modes. wireless cardsFollowing these steps correctly will ensure that your adapter becomes visible to the system again and can scan for available networks.

Why does WiFi disappear after using Airmon-ng?

The main reason for the internet disappearing is a change in the wireless adapter driver state. When you run the command airmon-ng start wlan0, the system creates a virtual interface (usually with a suffix mon), which takes over control of the physical device. At this point, the standard network manager NetworkManager forcibly disconnects or loses control of the adapter because it cannot control the device when it is in listen mode.

Additionally, Kali Linux may have various background services running by default that interfere with normal WiFi operation. Utilities such as wpa_supplicant or dhclient may remain running in the background, blocking reconnection attempts. This is a protective mechanism that prevents process conflicts, but it requires manual intervention to clean up.

Technical details of mode switching

In monitor mode, the card disconnects from a specific BSSID and begins forwarding all packets, including error and control packets, to user space. The driver changes the chip's state, and the operating system no longer sees the standard network interface.

It's important to understand that simply restarting the computer is sometimes insufficient if configuration files have been modified or if a driver is stuck in an intermediate state. Therefore, the most reliable method is to sequentially stop processes and switch modes via the command line. This gives you complete control over the situation and allows you to see errors in real time.

Checking the current state of interfaces

Before attempting to fix anything, you need to determine the exact state of your network interfaces right now. In Kali Linux, this is accomplished with a utility called ip or older ifconfig. Enter the command ip link show in the terminal to see a list of all network devices. You need to find your wireless adapter, which is usually labeled as wlan0, wlp2s0 or a similar name.

Pay attention to the device status. If there is no word next to the interface name UP, which means the interface is administratively down. It's also worth checking if there's still a monitoring interface with a name like wlan0monThe presence of such an interface indicates that the monitor mode is still active and needs to be forcibly terminated.

For more detailed information, use the command iwconfigIt will show what mode the adapter is operating in: Managed (controlled, normal mode) or Monitor (monitor mode). If you see the line Mode:Monitor, this confirms that the adapter is busy listening and cannot connect to WiFi. This command will also show whether you are connected to an access point (ESSID) or disconnected.

Stopping Monitor Mode and Background Processes

The first step to restoring WiFi is to properly exit monitor mode. Don't try to simply unplug the adapter or reboot; it's better to use the built-in tools. airmon-ng. Enter the command airmon-ng stop wlan0mon (replace wlan0mon (to the name of your monitoring interface). This command will reset the driver to its original state and remove the virtual interface.

However, this is often insufficient, as there may be "hanging" processes remaining in the system that have hijacked the device. To forcefully terminate them, use the command airmon-ng check killIt automatically finds and kills processes that interfere with WiFi, such as wpa_supplicant, dhclient And NetworkManagerBe careful: after running this command, you will temporarily lose control of the network through the GUI.

After executing the command airmon-ng check kill It is recommended to check the list of processes again with the command ps aux | grep -i wpato ensure they're truly stopped. If processes continue to appear, they may be started by a startup script, in which case a more in-depth system configuration intervention will be necessary. However, in 95% of cases, the standard shutdown procedure is sufficient.

Restart NetworkManager and restore the network

The most critical step is restarting the Network Manager. NetworkManager It's responsible for graphical display of available networks, saving passwords, and automatic connection. Without it, you'll be left with only the command line. To start the service, use the command:

sudo systemctl start NetworkManager

If the service is already running but is not working correctly, you can restart it with the command sudo systemctl restart NetworkManagerAfter this, a network icon should appear in the upper right corner of the screen. If the icon appears but networks aren't being scanned, try turning WiFi off and on using the graphical interface or command. nmcli radio wifi off followed by nmcli radio wifi on.

⚠️ Attention: If after restarting the service the network icon appears, but the connection is not established, check whether the adapter is blocked at the kernel level (RF-kill). Command rfkill list will show the blocking status. If it says "Soft blocked: yes", use rfkill unblock wifi.

In some cases, especially on virtual machines or specific laptops, it is also necessary to restart the interface itself. The command sudo ip link set wlan0 up will bring up the interface if it's down. After these manipulations, the system should behave as if nothing unusual happened and allow you to connect to the internet using standard methods.

Resolving common driver errors and conflicts

Even if the commands are executed correctly, errors may occur related to specific adapter models. For example, chip-based cards Realtek are known for being capricious when switching modes. If standard commands don't help, the driver may have crashed and require a full kernel module reload. This can be done with the command modprobe -r module_name and then modprobe module_name.

A common problem is the conflict between wpa_supplicant And NetworkManagerIf both processes try to control the same interface at the same time, the connection will be constantly reset. Make sure the configuration NetworkManager does not ignore managed devices. This is checked in the configuration file, where the parameter managed=true must be active.

Below is a table of common errors and how to solve them:

Alternative Methods for Managing WiFi in Kali

For those who prefer not to rely on a graphical interface or work in headless mode (without a monitor), there is a powerful tool nmcli (NetworkManager command line interface). It allows you to scan networks, connect to them, and manage IP settings. For example, the command nmcli dev wifi list will show a list of available networks, and nmcli dev wifi connect "SSID" password "PASS" will make the connection.

Another option is to use the utility wicd, which is a lighter alternative to NetworkManager. However, in modern Kali Linux, it is rarely used and may conflict with core services. If you decide to use wicd, be sure to remove or disable NetworkManagerto avoid port conflicts and interface management.

⚠️ Note: Command line interfaces and driver behavior may change depending on the Linux kernel version and package updates. kali-linux. Always check the command syntax against the official documentation or manuals (man airmon-ng), if standard methods do not work.

It is also worth mentioning the possibility of using connman (Connection Manager), which is often used in lightweight distributions. Its operating principles are similar, but the commands differ. However, for most Kali Linux users, the combination airmon-ng + NetworkManager remains the gold standard, providing a balance between the functionality of hacking tools and the convenience of everyday use.

Preventing future WiFi problems

To minimize problems with restoring WiFi after working with airmon-ng, it is recommended to develop the habit of always terminating your session gracefully. Do not shut down your computer abruptly while monitor mode is active. Create aliases for yourself in the file .bashrc to quickly switch modes. For example, you can create a script wifi-on, which will execute the entire chain of commands to restore the network with one click.

It's also helpful to keep up with driver and kernel updates. Kali Linux developers are constantly improving hardware support, and many adapter-related hangup bugs are fixed in new package releases. firmware-realtek or firmware-atherosRegular system updates by the team sudo apt update && sudo apt full-upgrade will help to avoid many compatibility problems.

If you frequently conduct security audits, consider using a separate USB WiFi adapter for attacks, leaving the built-in module for regular internet access. This will physically separate the traffic streams and eliminate the need to constantly switch operating modes on the same device. This approach significantly improves overall system stability.

Creating a quick recovery script

Create the file /usr/local/bin/wifi-fix with the following contents: #!/bin/bash \n ​​airmon-ng check kill \n systemctl restart NetworkManager \n Then make it executable: chmod +x /usr/local/bin/wifi-fix . Now the network restore takes one second.

Why did the internet disappear after airmon-ng check kill and the network icon doesn't appear?

Team check kill Forcefully stops the NetworkManager process to free up the adapter. It doesn't automatically restart it. You need to manually start the service with the command sudo systemctl start NetworkManagerWithout this step, the system is left without WiFi control.

Is it possible to surf the internet while airmon-ng is running?

Theoretically, it's possible if you use two different adapters: one in monitor mode for sniffing, and the other in managed mode for the internet. Downloading torrents and listening to the internet in monitor mode on the same adapter is not possible, as the chip's operating modes are incompatible.

How do I find out the name of my wireless interface?

Use the command ip link or iw devTypically wireless interfaces start with w (wlan0, wlp3s0), while wired ones - with e (eth0, enp3s0). In monitor mode, a suffix is ​​added to the name mon.

What should I do if the airmon-ng stop command does not kill the mon interface?

Try to remove the interface manually via ip link delete wlan0monIf this doesn't help, the driver may be frozen. In this case, the only solution is to physically reconnect the USB device or reboot the kernel module via modprobe -r And modprobe.

Do I need to kill processes every time before turning on WiFi?

Only if you have worked with it before airmon-ng or other auditing tools. For normal, everyday use of Kali Linux, these manipulations are not required. The NetworkManager service should run in the background at all times.