Airmon-ng

Interface monitor mode enable/disable tool

airmon-ng is tool to enable and disable monitor mode on wireless interfaces.

Wireless interfaces are typically name wlan followed with one or two digits.

---

Usage

1. Running airmon-ng without parameters displays the status and information about wireless interfaces

sudo airmon-ng

1. Some processes that start automatically; like NetworkManager ,dhclient , are known to interfere with AIRCRACK-NG suite and others use interfaces in monitor mode, to check these processes run:

sudo airmon-ng check

1. But to stop these processes we run the command below, first it tries to stop these processes then kills the rest of the processes 💀:

sudo airmon-ng check kill

---

Setup and configuration

We learned how to check our environment, now we want to take a bit further and learn how to prepare to monitor the network.

1. As mentioned before, this tool is used to enable monitor mode on the wireless interfaces; to do so we use the following command:

sudo airmon-ng start <WLAN Interface>

It appends mon at the end of interface name whenever its possible, but don't worry if your interface didn't show as in the image, some drivers don't allow you to change the name of the interface.

1. What if the tool we are going to use after starting the monitor mode does not have the ability to set a channel itself? simply we specify the channel number just by adding it after the command

sudo airmon-ng start <WLAN Interface> <Channel>

1. In the previous command, we specified the channel, but did it confirm it was set? Nope. Always verify everything is working before starting an attack. Use this command:

sudo iw dev <WLAN Interface> info

The result above shows that the interface is listening on the channel and frequency we want.

After the attack

You may want to connect to the Wi-Fi you hacked or just watch your favorite movie! But if your interface is still in monitor mode and you don’t have another one, your only option is to stop monitor mode and put everything back to normal.

1. Remember when I said some processes might mess with our tools? Yep NetworkManager! It manages your network interface, so you need to restart it. Here’s how:

sudo airmon-ng stop <WLAN Interface>

What we did here is that we only stopped the monitor mode. You are not able to use the interface yet?

no, I am not lying on you :) you are just one step away of enabling your interface!

1. To start the NetworkManager process we stopped (or killed) before, we need to apply the command below:

sudo systemctl start NetworkManager

And as you see the connection is working normally