How to Put WiFi Interface into Monitor Mode in Linux? (original) (raw)

Last Updated : 13 Sep, 2024

Before looking into Monitor mode and how to switch your WiFi mode from Managed to Monitor, it’s important to understand how a basic WiFi connection is established. When your system connects to WiFi, it sends packets to the WiFi network, which in turn acknowledges these packets, establishing a connection. Once connected, data packets can be sent to other devices within the same network through the WiFi router.

**What is Monitor Mode?

Monitor Mode is a special mode that allows a wireless network interface controller (NIC) to capture all wireless traffic in its range, even if the traffic is not destined for it. Unlike Managed mode, where your device only captures packets addressed to it, Monitor mode lets your device listen to all data packets being transmitted on the network. This is particularly useful for network troubleshooting, analyzing network traffic, or conducting security assessments.

The ways to do this are listed below:

Table of Content

• Using iw
• Using iwconfig
• Using airmon-ng

**Method 1: Using iw

The 'iw' tool is a command-line interface to manage wireless devices and their configurations. Follow these steps to enable Monitor mode using 'iw':

**Step 1: Identify the WiFi Interface

First, check the interface of the WiFi by using the command:

sudo iw dev

**Output:

As you can see clearly from the output the WiFi interface is "wlp1s0".

Step 2: Switch to Monitor Mode

After knowing the interface of the WiFi what we have to do is that down the WiFi interface then change its mode from managed to monitor and then up the WiFi. The commands used to do this task are

sudo ip link set wlp1s0 down sudo iw wlp1s0 set monitor none sudo ip link set wlp1s0 up

Now to check the status of the WiFi again run the first command:

sudo iw dev

**Output:

Step 3: Revert to Managed Mode

Once your task is done don't forget to put WiFi into Managed mode:

sudo ip link set wlp1s0 down sudo iw wlp1s0 set type managed sudo ip link set wlp1s0 up

Step 4: Verify the Change

Now to check the status of the WiFi again run the first command:

sudo iw dev

**Output:

**Method 2: Using iwconfig

'iwconfig' is another command-line tool used to configure wireless network interfaces. Here's how you can switch your WiFi mode using 'iwconfig':

Step 1: Identify the WiFi Interface

Again check the interface of the WiFi but this time with a different command.

sudo iwconfig

**Output:

Step 2: Switch to Monitor Mode

We have to do the same task we did in the first method i.e. down the WiFi interface, change its mode, and then up the interface but this time with different commands:

sudo ifconfig wlp1s0 down sudo iwconfig wlp1s0 mode monitor sudo ifconfig wlp1s0 up

Now check the WiFi status:

sudo iwconfig

**Output:

Step 3: Revert to Managed Mode

Put wifi in managed mode:

sudo ifconfig wlp1s0 down sudo iwconfig wlp1s0 mode managed sudo ifconfig wlp1s0 up

Now to check the status of the WiFi again run the first command:

sudo iwconfig

**Output:

**Method 3: Using airmon-ng

'airmon-ng' is part of the Aircrack-ng suite, designed for network monitoring and security testing. Follow these steps to enable Monitor mode using 'airmon-ng':

Step 1: Install Aircrack-ng

First, you need to install aircrack-ng using the command:

sudo apt-get install aircrack-ng

**Output:

Step 2: Identify the WiFi Interface

Once again check the interface of the WiFi but this time with a different command.

sudo airmon-ng

**Output:

Step 3: Check for Interfering Processes

The next step is to check the interfering processes by using the following command:

sudo airmon-ng check

**Output:

Step 4: Kill Interfering Processes

Now we have to kill these processes by using the command:

sudo airmon-ng check kill

**Output:

Step 5: Enable Monitor Mode

To put the interface into Monitor mode run the command:

sudo airmon-ng start wlp1s0

**Output:

Step 6: Verify the New Interface

Now a new interface is created let's check it using the command:

iwconfig

**Output:

Step 7: Stop Monitor Mode

Now we need to return to the original interface by using the following command:

sudo airmon-ng stop wlp1s0mon

**Output:

**Step 8: Check the Interface:

Check the interface by using the command:

iwconfig

**Output:

Conclusion

Monitor mode provides a powerful way to capture and analyze network traffic beyond the capabilities of Managed mode. Monitor mode offers comprehensive access to all packets in your WiFi's range by using tools like 'iw', 'iwconfig', or 'airmon-ng'. Always remember to switch back to Managed mode once your tasks are completed to restore normal network operations.