27

I have just successfully installed a driver (athk9_htc) for TP-Link TL-WN722N (a USB Wi-Fi adaptor) in Ubuntu 14.04.1. My goal is to capture Wi-Fi traffic with Wireshark.

I try to configure the adaptor to monitor mode by running: sudo iwconfig wlan1 mode monitor

However it gives me an error message:

Error for wireless request "Set Mode" (8B06):
    SET failed on device wlan1; Device or resource busy.

How can I set it to monitor mode?

Edited:

I do not agree this is a duplicated question. Actually I have found that thread before I asked this question. However there are two responses in that thread, but not any verified answer. If I do not ask this question again, how can I get the answer? Also the answer given by @chili555 is different to the responses in that thread, and I verified this answer is working. If the question is duplicated, shouldn't it be added as a comment in that thread to indicate that a verified answer is here, instead of indicating an answered question is a duplicated question?

Matthias Braun
  • 1,043
eepty
  • 525

5 Answers5

34

It may work if you first bring the interface down:

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

Check:

iwconfig

Not every device and driver combination are capable of monitor mode.

chili555
  • 60,188
  • 1
    Hold on. I bring down the inferface and configure it to monitor mode. then bring it up again sudo iwconfig wlan1 up . It is still in monitor mode when I run iwconfig. However then I connect it to a WiFi hot-spot, I found that it change back to managed mode...:( – eepty Aug 18 '14 at 14:02
  • I expect so. When you connect to an AP or hotspot, you are no longer monitoring. The AP is managing the channel, bit rate, etc. The behavior you describe is altogether correct. – chili555 Aug 18 '14 at 19:47
  • So I can start sniffing the WiFi with Wireshark without connecting it to an AP? – eepty Aug 19 '14 at 00:45
  • I am not experienced in wireshark, but I believe so. Please try. – chili555 Aug 19 '14 at 00:56
  • 1
    Yes I have just tested it. It works. – eepty Aug 19 '14 at 04:16
  • 1
    First, you must disconnect from the AP using the network manager. Then run the 2 commands (ifconfig and iwconfig) or else it will try to change back to monitor mode. – JBaczuk Apr 21 '17 at 02:08
  • 1
    wait if i'm not able to connect to a ap after putting it in monitor mode, is there a way to sniff data in a wifi network? i am trying to monitor my own network – Fuseteam Sep 28 '20 at 12:19
3

The best way to put your Wifi adapter to monitor mode is through airmon-ng.

You can install it by typing into a terminal sudo apt-get install aircrack-ng

Also, if you are using Wireshark, you have to run it as superuser to be able to put your adapter to monitor mode... :)

Pigeonaras
  • 538
  • 1
    I read some thread that saying running Wireshark as superuser is not a good idea. In this link it suggested a way to capture without root permission [http://askubuntu.com/questions/74059/how-do-i-run-wireshark-with-root-privileges]. However it failed when I follow this method. – eepty Aug 18 '14 at 13:39
  • Without root permissions, you are not able to set your adapter to monitor mode – Pigeonaras Aug 18 '14 at 13:41
  • Lets back to the question, I still get the same error after running sudo apt-get install aircrack-ng... – eepty Aug 18 '14 at 13:45
  • 2
    What makes you think this is the best way? – voices May 03 '17 at 19:46
  • For me, today airmon-ng stopped working to go into Monitor mode for external card. Internal was going. But ifconfig/iwconfig way worked. But iwconfig way don't give me new name like wlan1mon etc. Hope this does not matter! – Satya Prakash Oct 29 '17 at 09:20
1

Simple first make sure that you have installed drivers for your wireless adapter. Then if you want to enable monitor mode there are 2 methods to do it.

First method is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type iwconfig mode monitor and then ifconfig wlan0 up
  • type service NetworkManager restart before doing ifconfig wlan0 up.

Second way is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type airmon-ng start wlan0
  • then type service NetworkManager restart and ifconfig up.
Lorenz Keel
  • 8,905
Mihir
  • 11
0

I was facing the same issue, I disabled the network manager 1st and then able to put in monitor mode. Network manager is changing the mode back to managed mode after a while.

service NetworkManager stop

ifconfig wlp2s0 down
iwconfig wlp2s0 mode monitor
ifconfig wlp2s0 up
Jumshed Akhtar
  • 1
0

Assuming your Wi-Fi interface is wlp3s0, here's how you can set it to monitor mode:

systemctl stop NetworkManager
ip link set wlp3s0 down
iw wlp3s0 set type monitor
ip link set wlp3s0 up

Execute the commands as root or using sudo.

Matthias Braun
  • 1,043