Wifi interface mode switches automatically back to managed (Ubuntu 20.04)

Question

If I take the wifi interface offline: sudo ifconfig device_name down.

Then switch the mode to monitor: sudo iwconfig device_name mode monitor.

And then bring the device back online: sudo ifconfig device_name up.

It stays in monitor mode for about 3-5 seconds, then it automatically switches back to managed mode.

I checked it with iwconfig and also if I start running wireshark, it stops running because of this and gives an error The network adapter on which the capture was being done is no longer running; the capture has stopped.

How can I prevent this?

Answer 1

I suggest that it is Network Manager that is interfering. I also don't think that sudo ifconfig device_name on is correct. Please try:

sudo service NetworkManager stop
sudo ifconfig wlp0s20f3 down
sudo iwconfig wlp0s20f3 mode monitor
sudo ifconfig wlp0s20f3 up

Start wireshark and see if there is any improvement.

Answer 2

Interestingly, when I tried chili555's suggestion, it successfully put wlan1 in monitor mode, but completely disconnected wlan0. However, when I restarted NetworkManager, it restored wlan0 and left wlan1 in monitor mode.

Unfortunately, when I restarted the device, wlan1 was back to being set to monitor and reverting back to managed a few seconds later.

I've been running tens of these devices with one Wi-Fi connnected to an SSID and the other in monitor mode for years. I'm not sure what is different in this device's configuration to suddenly start behaving like this, but I started digging for an alternate solution, and found this: https://support.qacafe.com/cdrouter/knowledge-base/prevent-network-manager-from-controlling-an-interface/

Configure Network Manager to ignore test interfaces

Network Manager has a command line tool that can be used to see which interfaces it is controlling. Pull up a terminal window and type the following command:

nmcli dev status

This displays a table that lists all network interfaces along with their STATE. If Network Manager is not controlling an interface, its STATE will be listed as unmanaged. Any other value indicates the interface is under Network Manager control.

The preferred way to tell Network Manager to stop controlling an interface is by creating/updating a file in the /etc/NetworkManager/conf.d/ directory and giving it the following content. You can name the file anything with a .conf suffix, but all files in that directory will be read in asciibetical order. Files read later override snippets of files read earlier. Make sure the keyfile plugin is listed. Other plugins may be listed too.

[main] plugins=ifcfg-rh,keyfile

[keyfile] unmanaged-devices=interface-name:eth0;interface-name:wifi1

The keyfile section can also include wildcards and exceptions as follows:

[keyfile]
unmanaged-devices=interface-name:eth*,except:interface-name:eth0,except:interface-name:eth3;interface-name:wifi*

Interfaces can also be defined by their MAC addresses (in lower case):

[keyfile]
unmanaged-devices=mac:00:11:22:33:44:55;mac:66:77:88:99:00:aa 

Reboot for the changes to take effect.

The above solved my particular issue.