14

I have just successfully installed a driver (athk9_htc) for TP-Link TL-WN722N (a USB WiFi adaptor) in Ubuntu 14.04.1. My goal is to capture the WiFi traffic with Wireshark.

I try to configure the adaptor to monitor mode by running: sudo iwconfig wlan1 mode monitor However it give me an error message:

Error for wireless request "Set Mode" (8B06):
    SET failed on device wlan1; Device or resource busy.

How can I set it to monitor mode?

Edited: I do not agree this is a duplicated question. Actually I have found that thread before I asked this question. However there are two responses in that thread, but not any verified answer. If I do not ask this question again, how can I get the answer? Also the answer given by @chili555 is different to the responses in that thread, and I verified this answer is working. If the question is duplicated, should not it be adding a comment in that thread to indicate that a verified answer is here, instead of indicating an answered question is a duplicated question?

  • 2
    Not a duplicate at all, as it doesn't answer the question. – mikewhatever Jan 2 '15 at 10:54
20

It may work if you first bring the interface down:

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

Check:

iwconfig

Not every device and driver combination are capable of monitor mode.

  • Hold on. I bring down the inferface and configure it to monitor mode. then bring it up again sudo iwconfig wlan1 up . It is still in monitor mode when I run iwconfig. However then I connect it to a WiFi hot-spot, I found that it change back to managed mode...:( – eepty Aug 18 '14 at 14:02
  • I expect so. When you connect to an AP or hotspot, you are no longer monitoring. The AP is managing the channel, bit rate, etc. The behavior you describe is altogether correct. – chili555 Aug 18 '14 at 19:47
  • So I can start sniffing the WiFi with Wireshark without connecting it to an AP? – eepty Aug 19 '14 at 0:45
  • 1
    Yes I have just tested it. It works. – eepty Aug 19 '14 at 4:16
  • 1
    First, you must disconnect from the AP using the network manager. Then run the 2 commands (ifconfig and iwconfig) or else it will try to change back to monitor mode. – JBaczuk Apr 21 '17 at 2:08
3

The best way to put your Wifi adapter to monitor mode is through airmon-ng.

You can install it by typing into a terminal sudo apt-get install aircrack-ng

Also, if you are using Wireshark, you have to run it as superuser to be able to put your adapter to monitor mode... :)

  • 1
    I read some thread that saying running Wireshark as superuser is not a good idea. In this link it suggested a way to capture without root permission [askubuntu.com/questions/74059/…. However it failed when I follow this method. – eepty Aug 18 '14 at 13:39
  • Without root permissions, you are not able to set your adapter to monitor mode – Pigeonaras Aug 18 '14 at 13:41
  • Lets back to the question, I still get the same error after running sudo apt-get install aircrack-ng... – eepty Aug 18 '14 at 13:45
  • 2
    What makes you think this is the best way? – tjt263 May 3 '17 at 19:46
  • For me, today airmon-ng stopped working to go into Monitor mode for external card. Internal was going. But ifconfig/iwconfig way worked. But iwconfig way don't give me new name like wlan1mon etc. Hope this does not matter! – Satya Prakash Oct 29 '17 at 9:20

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.