April 10, 2021


Cyber Security Assistance For Ducklings and Decoys…

Monitor Mode and linux compatible USB wireless adapters

What is "Monitor Mode" and how to use it

Monitor mode, or RFMON (Radio Frequency MONitor) mode, allows a computer with a wireless network interface controller (WNIC) to monitor all traffic received on a wireless channel.  Monitor mode allows packets to be captured without having to associate with an access point first.  This is how Offensive Security and Ethical Hacking work using Kali Linux, for example. Your laptop's WNIC is set to "Managed Mode" by default allowing your machine to connect to your router for Internet service.  Switching into monitor mode allows your USB network adapter to literally scan and intercept wireless communications not necessarily intended for your device.  We recommend the "Alfa Network Atheros AR9271" as only a limited few USB network adapters on the market allow monitor mode for obvious reasons.  You can also purchase a 14" antenna for the Alfa Network Atheros device for extended range.  Please see below for purchase on Amazon.  Also, ignore the compatible Operating Systems as it does not list Linux because most people do not use it.

Alfa USB Wireless Adapter

Enabling Monitor Mode using a Terminal in Kali Linux.  Enter the following commands in this order:

1.  sudo su  (elevates user priveleges to "Root")
2.  iwconfig  (check to see whether your wireless interface is wlan0 or wlan1)
3.  airmon-ng start wlan0  (or wlan1, whichever is your wireless interface)
4.  airmon-ng check kill  (this kills processes that can cause your interface
to automatically revert back to "managed mode")
5.  iwconfig  (checks to see that the wireless interface has initiated "monitor
mode"...you will see that the interface name has changed from wlan0 to wlan0mon)
1.  airmon-ng stop wlan0mon
2.  dhclient wlan0

Close Bitnami banner