Skip to content

Monitor interface overview, creating monitor interfaces

Murad edited this page Jul 2, 2022 · 11 revisions

CLI way

Monitor interface can be created on any phy since Linux always supports monitor interface mode in software, regardless of driver features on a given WiFi NIC. To create a monitor mode interface wlan0monitor0 on device phy0, use iw phy phy0 interface add wlan0monitor0 type monitor && ip link set wlan0monitor0 up. Resulting monitor mode can be used in wireshark to sniff packets.

Caveats

Your NIC may not support multiple modes at once. You can always see combinations supported by your NIC using iw list | egrep -A2 'interface combinations|Wiphy'.

This article has been tested on:

Owner name NIC name Vendor code Device code Comment
@foxpy Intel Corporation Wi-Fi 6 AX200 (rev 1a) 8086 2723 Everything is OK, interface mode works parallel to station mode, wireshark prints sniffed packets in monitor mode
@foxpy Intel Corporation Centrino Wireless-N 2200 8086 0891 Everything is OK, though I have noticed this older NIC outputs way more packets in monitor mode
@foxpy ASUSTek Computer, Inc. 802.11ac NIC 0b05 184c Some kernel threads hang after attempt to add monitor mode interface. Attempt to delete default station mode interface also hangs kernel. Driver for this NIC is cursed (I guess this NIC should be blacklisted)
Clone this wiki locally