Network Cards: Managed Into Monitor Mode (Guide)

Network Cards: Managed Into Monitor Mode

Here's a guide on how to get managed into monitor mode across different network cards and operating systems.

First: Kill Interfering Processes

NetworkManager, wpa_supplicant, dhclient, and avahi will fight you. Kill them first.

bash

# The nuclear option — kills everything that touches WiFi
sudo airmon-ng check kill

# Restore them later:
sudo airmon-ng check kill --restore
# Or manually:
sudo systemctl restart NetworkManager

Method 1: airmon-ng (Simplest, Most Reliable)

bash

# List wireless interfaces
sudo airmon-ng

# Start monitor mode
sudo airmon-ng start wlan0

# Your interface is now wlan0mon (or mon0 on older systems)
iwconfig wlan0mon
# Should show: Mode:Monitor

# When done:
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager

Method 2: iw (Direct, No Renaming)

bash

# Check interface info
iw dev wlan0 info

# Set monitor mode
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify
iw dev wlan0 info
# Should show: type monitor

# Revert:
sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up

Method 3: iwconfig (Legacy)

bash

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ifconfig wlan0 up

# Verify
iwconfig wlan0
# Mode:Monitor

Set a Specific Channel

Monitor mode locks onto one channel by default. Set it:

bash

# airmon-ng method
sudo airmon-ng start wlan0 6    # Channel 6

# iw method
sudo iw dev wlan0 set channel 6

# Verify channel
iw dev wlan0 info | grep channel

Channel Hopping

To scan across channels:

bash

# airodump-ng hops automatically
sudo airodump-ng wlan0mon

# Manual hopping with iw
for ch in 1 6 11; do
    sudo iw dev wlan0 set channel $ch
    sleep 2
done

Troubleshooting by Chipset

"SET failed on device wlan0 ; Device or resource busy"

Something is still using the card:

bash

# Find what's using it
sudo lsof /dev/wlan0
sudo fuser wlan0

# Or be thorough:
sudo airmon-ng check
sudo airmon-ng check kill

Intel Chipsets (iwlwifi)

Intel cards are notoriously bad at injection but monitor mode works:

bash

# Most Intel cards work with iw method only
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# If "command failed: Operation not supported (-95)"
# Your Intel card's firmware blocks monitor mode
# Only solution: use an external USB adapter

Broadcom (brcmfmac)

Spotty. Some work, many don't:

bash

# Try iw method first
# If it fails, your only option is a USB adapter

Realtek (rtl88xx, rtl8187, rtl8192)

Generally cooperative:

bash

sudo airmon-ng start wlan0
# Works on most Realtek chipsets

MediaTek/Ralink (mt76, rt2800usb)

The gold standard. These just work:

bash

sudo airmon-ng start wlan0
# Rock solid monitor mode and packet injection

macOS (for reference)

bash

# macOS doesn't support monitor mode on built-in hardware
# Use a USB adapter with Kali in a VM
# Or use the built-in wireless diagnostics:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
sudo airport en0 sniff 6    # Channel 6, captures to /tmp

Quick Validation Script

bash

#!/bin/bash
# verify_monitor.sh — confirm monitor mode and test injection

IFACE=${1:-wlan0mon}

echo "[*] Checking interface $IFACE..."

# Check mode
MODE=$(iwconfig $IFACE 2>/dev/null | grep -o "Mode:[A-Za-z]*" | cut -d: -f2)
if [ "$MODE" = "Monitor" ]; then
    echo "[+] Mode: Monitor ✓"
else
    echo "[-] Mode: $MODE (expected Monitor)"
    echo "[!] Run: sudo airmon-ng start wlan0"
    exit 1
fi

# Check channel
CH=$(iw dev $IFACE info 2>/dev/null | grep channel | awk '{print $2}')
echo "[+] Channel: $CH"

# Test injection (nearby APs)
echo "[*] Testing packet injection..."
sudo aireplay-ng -9 $IFACE
# -9 = injection test
# Look for "Injection is working!" in output

echo "[*] Done. Run: sudo airodump-ng $IFACE"

Run it:

bash

chmod +x verify_monitor.sh
./verify_monitor.sh wlan0mon