Working with wireless networks in the environment Kali Linux It all starts with a fundamental step: successfully activating the network interface. Beginners often encounter a situation where, after installing the system on a screen or in a virtual machine, the wireless module remains invisible or blocked. This may be due to a lack of proprietary drivers, hardware blocking via rfkill, or a specific virtualization feature that, by default, does not forward USB devices to the guest OS.
Understanding how to manage network interfaces is critical for conducting a security audit. Without a properly functioning adapter, it's impossible to scan the air, intercept packets, or analyze access point vulnerabilities. Unlike traditional distributions, where connection occurs automatically, Kali often requires manual intervention to configure the card to operate properly.
In this guide, we'll cover every step: from diagnosing the device's status to installing any missing software. You'll learn to distinguish between software and hardware locks, and understand why some external adapters require special configuration before use. Please note: All actions are performed as superuser, so be careful when entering commands.
Diagnosing the status of the wireless interface
The first step should always be to check if the adapter is visible to the system. Even if the device's indicators are lit, the operating system may not have a driver to interact with it. Use a utility ip link or more detailed iwconfigto see a list of available interfaces. Internal cards are usually labeled as wlan0, and external USB adapters may have names like wlx followed by the MAC address.
If the command line returns an error or shows an empty list, this is a sign of a deeper problem. It often happens that the interface exists, but is in a state DOWNIn this case, it must be raised manually. It's also worth checking whether the module is locked at a low level. There's a specialized tool for this that displays the lock status for each device.
Run the command rfkill list To get the full picture, you'll see two types of blocks: Soft blocked (software) and Hard blocked (hardware). The first can be fixed using software, while the second requires physically switching a switch on the laptop case or pressing the Fn key combination.
⚠️ Note: If you see the "Hard blocked: yes" status, no commands in the terminal will help until you toggle the physical switch or disable the lock in your device's BIOS/UEFI.
To remove the software lock, use the unlock all devices command. This is a standard procedure that solves 80% of WiFi invisibility issues in Kali.
sudo rfkill unblock allAfter running this command, check the interface list again. If the status changes to "no," then the activation path is open. However, if the interface still doesn't appear in the list iwconfig, the system may be missing microcode or driver for your specific chipset model.
Installing and updating WiFi drivers
One of the most common reasons for wireless card failure is the lack of a suitable driver. The Linux kernel contains many open-source drivers, but some manufacturers use proprietary solutions that require separate installation. This is especially true for chip-based adapters. Realtek And MediaTek, which are popular among security professionals due to their support for monitor mode.
Before searching for drivers manually, make sure your repositories are up to date. Kali Linux regularly releases kernel and module updates, which may already contain the necessary software. Update your package lists and install the base driver sets.
sudo apt update
sudo apt install -y kali-linux-headless
If automatic installation doesn't help, you need to identify the exact model of your device. Use the utility lsusb for USB adapters or lspci For internal PCIe cards, find the line with the description of your device and write down the vendor and product ID (e.g., 0bda:8812). This information will be needed to search for a specific driver in repositories or on GitHub.
Kernel headers often need to be installed (linux-headers) before compiling the drivers. Without them, building the module is impossible. Install them using the command corresponding to your kernel version to ensure compatibility.
⚠️ Warning: When installing drivers from third-party sources (not from the official Kali repositories), always verify the file hashes. Using unverified binaries can compromise your security.
In some cases, reinstalling firmware packages helps. These contain binary blobs required for many wireless cards to function.
sudo apt install -y firmware-realtek firmware-misc-nonfreeAfter installing any new drivers or firmware, be sure to reboot your system or reconnect the USB device for the changes to take effect.
Activating the interface and obtaining an IP address
When the driver is installed and the locks are removed, the interface may still be in an inactive state. In modern distributions, network management is often handled by a service called NetworkManager, but in Kali, for professional work, people often use classic tools or switch to manual control. First, try bringing up the interface with the command ip link set dev wlan0 up.
If the interface has successfully transitioned to the UP state, the next step is connecting to the network. For regular internet access, you can use the graphical interface or a utility. nmtui, which provides a text menu. However, security testing often requires a static IP or running in monitor mode, which is more conveniently done through the console.
To automatically obtain an address via DHCP, use a client dhcpcd or dhclientThis will allow your card to receive an address from the router and access the network.
sudo dhcpcd wlan0It's important to understand the difference between managed mode and monitor mode. In normal mode, the card behaves like a standard client. Enabling WiFi in Kali Linux in promiscuous mode requires additional steps, which will be discussed below. For now, make sure the basic connection is working: you can ping the gateway and access external resources.
If you use NetworkManager, it may conflict with manual settings. In this case, it is recommended to temporarily disable management of this interface via NetworkManager to regain full control over the card.
Switching the adapter to monitor mode
The card's standard operating mode is not suitable for conducting a wireless network security audit. You must switch the interface to the default mode. Monitor, which allows you to capture all packets in the air, regardless of whether they're addressed to you or not. This is a key step in traffic analysis and penetration testing.
Before switching the mode, you must stop any processes that may be using the interface. Services like NetworkManager or wpa_supplicant will interfere with the mode change because they are trying to maintain a stable connection. Use the command airmon-ng check kill to automatically terminate conflicting processes.
Next, activate the monitor mode using the utility airmon-ngThis command will create a virtual interface, usually with a suffix mon (For example, wlan0mon).
sudo airmon-ng start wlan0After launching, check the status of the new interface with the command iwconfig. The Mode line must contain the following: MonitorYour card is now ready for passive listening. Please note that in this mode, you won't be able to connect to WiFi hotspots as a regular user until you return to Managed mode.
⚠️ Warning: Monitor mode may be detected by intrusion detection systems (WIDS). Use this mode only on networks you own or have written permission to test.
To return to normal mode, use the command airmon-ng stop wlan0mon and restart the network service. This will restore the adapter's ability to connect to the internet normally.
Troubleshooting virtual machines
Users running Kali Linux in VirtualBox or VMware often encounter an invisible WiFi adapter within the guest system. This is because the virtual machine, by default, uses a virtual network adapter that emulates a wired connection (NAT or Bridge) rather than forwarding the host's physical WiFi module. To use wireless functionality, a USB device must be forwarded.
In the virtual machine settings, find the USB section and enable the controller (preferably USB 3.0). Then add a filter for your WiFi adapter by selecting it from the list of connected devices. After this, the guest OS will disconnect from the virtual network cable and see the real USB device.
If the device is not detected after forwarding, it may not be installed Guest Additions (for VirtualBox) or VMware ToolsThese packages ensure proper driver operation and hardware integration. Also, ensure that the WiFi drivers on the host machine (your primary OS) aren't intercepting access to the device.
It's worth noting that not all adapters support monitor mode when running through a virtual machine. Some drivers lose this functionality when forwarded through the host's USB gateway. In such cases, it's recommended to use Kali Linux in Live USB mode or a bare-metal installation.
Comparison of popular WiFi adapters for Kali
Choosing the right hardware is half the battle. Not all adapters work equally well with Linux and support the necessary features. Below is a table comparing popular models used in the information security industry.
| Adapter model | Chipset | Monitor Mode support | Injection Support | Interface |
|---|---|---|---|---|
| Alfa AWUS036NHA | Atheros AR9271 | Yes (Excellent) | Yes | USB 2.0 |
| Alfa AWUS036ACS | Realtek RTL8812AU | Yes | Yes | USB 2.0 |
| Panda PAU09 | Ralink RT5572 | Yes | Yes | USB 2.0 |
| TP-Link TL-WN722N (v1) | Atheros AR9271 | Yes | Yes | USB 2.0 |
| Built-in Intel | Intel Various | Partially | Rarely | PCIe |
As can be seen from the table, devices based on chipsets Atheros And Realtek are the most preferred. They have excellent support in the Linux kernel and work reliably with tools like Aircrack-ng. Integrated Intel cards often require complex configuration and may not support packet injection.
When purchasing, pay attention to the device version. For example, the TP-Link WN722N versions 2 and 3 use Realtek chipsets, which may not support the required functionality out of the box. Always check the specifications before purchasing.
Frequently Asked Questions (FAQ)
Why does the iwconfig command show the interface but not the network?
Most likely, the interface is blocked by software or hardware. Check the status via rfkill listIf there are no blocks, make sure you are using the correct command for scanning, for example sudo iwlist wlan0 scan, since it's normal scan may require root privileges.
Can I use my laptop's built-in WiFi for auditing?
Theoretically, yes, if the chipset supports monitor mode and injection. However, in practice, integrated cards often have weak antennas and drivers that don't work well with penetration testing tools. For serious work, it's better to use an external adapter with an external antenna.
How to restore internet connection after working in monitor mode?
You need to stop the monitor mode with the command sudo airmon-ng stop wlan0mon, then launch the network manager or use dhcpcd to obtain an IP address. You may also need to restart the NetworkManager service: sudo systemctl restart NetworkManager.
What to do if the Realtek driver does not install?
Make sure the kernel headers are installed (linux-headers) and compiler build-essentialOften, the problem is solved by removing old versions of the driver and cloning a fresh repository from GitHub that matches your kernel version.