Interface Setup

Overview

Monitor mode allows a wireless interface to capture all 802.11 frames on a channel, not just frames addressed to the host. Required for passive sniffing, handshake capture, and injection attacks. airmon-ng handles enabling and disabling monitor mode and kills conflicting processes (NetworkManager, wpa_supplicant) that interfere with packet injection.

Kill Interfering Processes

Stops background services that conflict with monitor mode:

sudo airmon-ng check kill

Enable Monitor Mode

sudo airmon-ng start <WIFI-INTERFACE>

Creates a new virtual interface (e.g. wlan0mon) in monitor mode.

Disable Monitor Mode

sudo airmon-ng stop <WIFI-INTERFACE>

Destroys the monitor interface and restores managed mode.

Manual Channel Change

Lock a monitor-mode interface to a specific channel:

sudo iwconfig <INTERFACE-MON> channel <NUMBER>

MAC Address Spoofing

Change the interface MAC before connecting or launching a rogue AP:

systemctl stop network-manager
ip link set <INTERFACE> down
macchanger -m <NEW-MAC> <INTERFACE>
ip link set <INTERFACE> up

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Interface Setup

Overview

Kill Interfering Processes

Enable Monitor Mode

Disable Monitor Mode

Manual Channel Change

MAC Address Spoofing

​Overview

​Kill Interfering Processes

​Enable Monitor Mode

​Disable Monitor Mode

​Manual Channel Change

​MAC Address Spoofing

Overview

Kill Interfering Processes

Enable Monitor Mode

Disable Monitor Mode

Manual Channel Change

MAC Address Spoofing