What is monitor mode in Linux?
Monitor mode is a special mode for wireless network interface controllers (NICs) in Linux. It allows the NIC to capture all wireless traffic that it can detect, including data transmitted by other devices, without being associated with a specific access point.
In monitor mode, the NIC operates in a “passive” mode, simply monitoring and capturing the wireless traffic, rather than actively participating in the communication. This allows the NIC to capture all wireless traffic within range, even if it is not intended for the device running the NIC.
Monitor mode is commonly used in security testing and wireless network analysis, as it allows the user to see all wireless network activity and perform various types of scans and attacks. However, it is important to note that using monitor mode can be illegal in some countries and is only recommended for authorized and legitimate purposes, such as penetration testing or network analysis.
How to keep your wireless interface in monitor mode in Linux?
To set up monitor mode in Linux, you need to use a wireless card that supports monitor mode, and a tool such as aircrack-ng or iwconfig. Here’s a general process for setting up monitor mode using iwconfig:
- Find the name of your wireless card:
iwconfig
- Put the wireless card into monitor mode:
sudo ifconfig <interface_name> down sudo iwconfig <interface_name> mode monitor sudo ifconfig <interface_name> up
Replace <interface_name> with the name of your wireless card, for example wlp0s20f3.
- Verify that the wireless card is in monitor mode:
iwconfig
Note: The exact steps to set up monitor mode may vary depending on the distribution of Linux you are using and the version of the wireless card driver.
How to revert your wireless interface back to managed mode?
To remove monitor mode in Linux, you need to use a tool such as iwconfig or airmon-ng. Here’s a general process for removing monitor mode using iwconfig:
- Find the name of your wireless card:
iwconfig
- Put the wireless card back into managed mode:
sudo ifconfig <interface_name> down sudo iwconfig <interface_name> mode managed sudo ifconfig <interface_name> up