27

I have just successfully installed a driver (athk9_htc) for TP-Link TL-WN722N (a USB WiFi adaptor) in Ubuntu 14.04.1. My goal is to capture the WiFi traffic with Wireshark.

I try to configure the adaptor to monitor mode by running: sudo iwconfig wlan1 mode monitor However it give me an error message:

Error for wireless request "Set Mode" (8B06):
    SET failed on device wlan1; Device or resource busy.

How can I set it to monitor mode?

Edited: I do not agree this is a duplicated question. Actually I have found that thread before I asked this question. However there are two responses in that thread, but not any verified answer. If I do not ask this question again, how can I get the answer? Also the answer given by @chili555 is different to the responses in that thread, and I verified this answer is working. If the question is duplicated, should not it be adding a comment in that thread to indicate that a verified answer is here, instead of indicating an answered question is a duplicated question?

1
  • 3
    Not a duplicate at all, as it doesn't answer the question. – mikewhatever Jan 2 '15 at 10:54
34

It may work if you first bring the interface down:

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

Check:

iwconfig

Not every device and driver combination are capable of monitor mode.

7
  • Hold on. I bring down the inferface and configure it to monitor mode. then bring it up again sudo iwconfig wlan1 up . It is still in monitor mode when I run iwconfig. However then I connect it to a WiFi hot-spot, I found that it change back to managed mode...:( – eepty Aug 18 '14 at 14:02
  • I expect so. When you connect to an AP or hotspot, you are no longer monitoring. The AP is managing the channel, bit rate, etc. The behavior you describe is altogether correct. – chili555 Aug 18 '14 at 19:47
  • So I can start sniffing the WiFi with Wireshark without connecting it to an AP? – eepty Aug 19 '14 at 0:45
  • 1
    Yes I have just tested it. It works. – eepty Aug 19 '14 at 4:16
  • 1
    First, you must disconnect from the AP using the network manager. Then run the 2 commands (ifconfig and iwconfig) or else it will try to change back to monitor mode. – JBaczuk Apr 21 '17 at 2:08
3

The best way to put your Wifi adapter to monitor mode is through airmon-ng.

You can install it by typing into a terminal sudo apt-get install aircrack-ng

Also, if you are using Wireshark, you have to run it as superuser to be able to put your adapter to monitor mode... :)

5
  • 1
    I read some thread that saying running Wireshark as superuser is not a good idea. In this link it suggested a way to capture without root permission [askubuntu.com/questions/74059/…. However it failed when I follow this method. – eepty Aug 18 '14 at 13:39
  • Without root permissions, you are not able to set your adapter to monitor mode – Pigeonaras Aug 18 '14 at 13:41
  • Lets back to the question, I still get the same error after running sudo apt-get install aircrack-ng... – eepty Aug 18 '14 at 13:45
  • 2
    What makes you think this is the best way? – voices May 3 '17 at 19:46
  • For me, today airmon-ng stopped working to go into Monitor mode for external card. Internal was going. But ifconfig/iwconfig way worked. But iwconfig way don't give me new name like wlan1mon etc. Hope this does not matter! – Satya Prakash Oct 29 '17 at 9:20
1

Simple first make sure that you have installed drivers for your wireless adapter. Then if you want to enable monitor mode there are 2 methods to do it.

First method is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type iwconfig mode monitor and then ifconfig wlan0 up
  • type service NetworkManager restart before doing ifconfig wlan0 up.

Second way is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type airmon-ng start wlan0
  • then type service NetworkManager restart and ifconfig up.
0

I was facing the same issue, I disabled the network manager 1st and then able to put in monitor mode. Network manager is changing the mode back to managed mode after a while.

service NetworkManager stop

ifconfig wlp2s0 down
iwconfig wlp2s0 mode monitor
ifconfig wlp2s0 up

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.