How to Enable/Disable Monitor Mode in Linux (using 3 Methods)

If you are a penetration tester, network administrator, or security professional diving into the realm of WiFi pentesting, your journey will involve enabling monitor mode on your Network Interface Card (NIC).

In this article, we go over what monitor and managed modes are in your NIC, how to see if your NIC supports monitor mode, and how to enable and disable monitor mode using three different techniques.

What is Monitor Mode?

Monitor mode is a feature of the NIC that allows users to monitor and inspect network traffic (or activity) on their networks, requiring manual activation by the users when needed.

Certain NIC providers, like Alfa, Panda, D-Link, etc., offer monitor mode through special chipsets, typically Realtek or Atheros, allowing users to enable monitor mode and package injection.

When discussing monitor mode, package injection is another commonly used term. It’s simply another feature of monitor mode-supported NICs that allows users to interfere (forge or spoof packets) on the network.

Most NIC providers that do not offer monitor mode typically provide a managed mode, which is much more commonly used for normal WiFi connections (a client connecting to an access point).

I hope you now understand terms such as monitor mode, packet injection, and managed mode. So, let’s find out if your current NIC supports monitor mode.

How to Check Monitor Mode is Supported by Your NIC

The best way to check support for monitor mode on your NIC (or WiFi adapter) is by identifying its chipset and then checking on the internet or its official site to see if they offer support.

If you’re running a Linux or macOS system, run the following command to list all NICs attached to your system along with their chipset names:

#Built-in Tools
$ lspci                             					                                            #PCI Based Wi-Fi Hardware
$ lsusb                           					                                            #External Wi-fi Hardware

#External Tools
$ sudo lshw                                                                                                       #List all network devices

If you’re running a Windows system, then run the following command:

$ netsh wlan show drivers

Once you’ve identified your chipset and found that it offers support for monitor mode, you can enable it by following the three methods mentioned in this article.

How to Enable Monitor Mode in Linux (using 3 Methods)

The following are the three commands that you can use to enable monitor mode in Linux:

• iw command: It’s a new tool that comes preinstalled on modern Linux distributions but may require manual installation on some.
• airmon-ng command: It’s shipped out of the box in Kali Linux, but for others, it requires manual installation from the default package manager.
• iwconfig command: It’s a deprecated tool, but it still exists and works on a few Linux distributions.

Identify the NIC or WiFi Adapter

Before proceeding to enable monitor mode for your NIC, you must first identify its interface name, which will serve as a parameter for the other commands when enabling monitor mode.

In Linux, simply execute the following command to list all NIC information alongside their interface names:

$ ip addr show

#OR

$ iw dev

Output:

The above is the list of attached NICs to my Linux system, and “wls192u2” will be the one that I’ll use to enable monitor mode.

Method 1: Enable Monitor Mode using the iw command in Linux

The “iw” command is used for WiFi configuration or to fetch information about an attached NIC or WiFi adapter, such as interface, ifindex, mac address, SSID, mode type, channel, and txpower.

Execute the following command to check your interface information:

$ iw dev

Output:

As previously discussed, I’ll enable monitor mode for my attached WiFi adapter with the interface name “wls192u2” (which will be different in your case).

To achieve that, we simply need to execute the following three commands, substituting the “INTERFACE” parameter with the actual interface name.

$ sudo ip link set INTERFACE down
$ sudo iw INTERFACE set monitor control
$ sudo ip link set INTERFACE up

Output:

Once monitor is enabled, re-execute the following command to check the status of the interface.

$ iw dev

Output:

Disable the Monitor Mode Enabled by iw Command

Once you’re done monitoring, you can disable the monitor mode by restoring the hardware mode to its default “managed” state with the execution of the following commands:

$ sudo ip link set INTERFACE down
$ sudo iw INTERFACE set type managed
$ sudo ip link set INTERFACE up

Then recheck the status of the wireless interface using the “iw dev” command.

Method 2: Enable Monitor Mode using the airmon-ng command in Linux

Airmon-ng is quite a popular tool among Kali Linux users for performing various WiFi pentesting tasks. One advantage for Kali Linux users is that this tool comes pre-installed, but users of a different system can easily install it by running the following command:

$ sudo apt install aircrack-ng                                                                #On Debian, Ubuntu, Mint, etc.
$ sudo dnf install aircrack-ng                                                                #On Redhat, Fedora, AlmaLinux, etc.
$ sudo pacman -S aircrack-ng                                                              #On Arch, Manjaro, EndeavourOS

Once the installation is complete, you can execute the following command to check your interface information:

$ sudo airmon-ng

Output:

Prior to enabling monitor mode, execute the following command to check if any application or utility could cause a problem: Once identified, close them using the next command.

$ sudo airmon-ng check
$ sudo airmon-ng check kill

Output:

Now, enable monitor mode by replacing the “INTERFACE” parameter with the actual interface name in the following command.

$ sudo airmon-ng start INTERFACE

Output:

Once the monitor mode is started on your interface, it will add the “mon” parameter at the end of the interface name, which basically means it turns “wls192u2” into “wls192u2mon“. To verify, run the following command:

$ iw dev

#OR

$ sudo airmon-ng

Output:

Disable the Monitor Mode Enabled by airmon-ng command

After finishing monitoring tasks, you can switch the wireless network adapter to managed mode by specifying the interface name with the “mon” prefix to the “airmon-ng” command, then restart the system network manager.

$ sudo airmon-ng stop INTERFACEmon
$ sudo systemctl restart NetworkManager

Output:

Method 3: Enable Monitor Mode using the iwconfig command in Linux

While the “iwconfig” command remains accessible, it’s been deprecated in favor of the “iw” command we covered earlier. Though options and parameters might be similar, I strongly advise using “iw” for its updated functionality and security.

However, if you resist, you can enable monitor mode using “iwconfig” command by running:

$ sudo ifconfig INTERFACE down
$ sudo iwconfig INTERFACE mode monitor
$ sudo ifconfig INTERFACE up

Later, to stop monitor mode, you can execute the following commands:

$ sudo ifconfig INTERFACE down
$ sudo iwconfig INTERFACE mode managed
$ sudo ifconfig INTERFACE up

Final Word

If you ask about my preferences, I mostly use the “airmon-ng” command to enable monitor mode. However, the “iw” command remains useful in certain scenarios, but I rarely use the “iwconfig” command.

If you want to learn more about such a topic, do let me know in the comment section.

Till then, peace!