27

I have just successfully installed a driver (athk9_htc) for TP-Link TL-WN722N (a USB Wi-Fi adaptor) in Ubuntu 14.04.1. My goal is to capture Wi-Fi traffic with Wireshark.

I try to configure the adaptor to monitor mode by running: sudo iwconfig wlan1 mode monitor

However it gives me an error message:

Error for wireless request "Set Mode" (8B06):
    SET failed on device wlan1; Device or resource busy.

How can I set it to monitor mode?

Edited:

I do not agree this is a duplicated question. Actually I have found that thread before I asked this question. However there are two responses in that thread, but not any verified answer. If I do not ask this question again, how can I get the answer? Also the answer given by @chili555 is different to the responses in that thread, and I verified this answer is working. If the question is duplicated, shouldn't it be added as a comment in that thread to indicate that a verified answer is here, instead of indicating an answered question is a duplicated question?

1
  • 4
    Not a duplicate at all, as it doesn't answer the question. Jan 2, 2015 at 10:54

5 Answers 5

34

It may work if you first bring the interface down:

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

Check:

iwconfig

Not every device and driver combination are capable of monitor mode.

7
  • 1
    Hold on. I bring down the inferface and configure it to monitor mode. then bring it up again sudo iwconfig wlan1 up . It is still in monitor mode when I run iwconfig. However then I connect it to a WiFi hot-spot, I found that it change back to managed mode...:(
    – eepty
    Aug 18, 2014 at 14:02
  • I expect so. When you connect to an AP or hotspot, you are no longer monitoring. The AP is managing the channel, bit rate, etc. The behavior you describe is altogether correct.
    – chili555
    Aug 18, 2014 at 19:47
  • 1
    Yes I have just tested it. It works.
    – eepty
    Aug 19, 2014 at 4:16
  • 1
    First, you must disconnect from the AP using the network manager. Then run the 2 commands (ifconfig and iwconfig) or else it will try to change back to monitor mode.
    – JBaczuk
    Apr 21, 2017 at 2:08
  • 1
    wait if i'm not able to connect to a ap after putting it in monitor mode, is there a way to sniff data in a wifi network? i am trying to monitor my own network
    – Fuseteam
    Sep 28, 2020 at 12:19
3

The best way to put your Wifi adapter to monitor mode is through airmon-ng.

You can install it by typing into a terminal sudo apt-get install aircrack-ng

Also, if you are using Wireshark, you have to run it as superuser to be able to put your adapter to monitor mode... :)

5
  • 1
    I read some thread that saying running Wireshark as superuser is not a good idea. In this link it suggested a way to capture without root permission [askubuntu.com/questions/74059/…. However it failed when I follow this method.
    – eepty
    Aug 18, 2014 at 13:39
  • Without root permissions, you are not able to set your adapter to monitor mode
    – Pigeonaras
    Aug 18, 2014 at 13:41
  • Lets back to the question, I still get the same error after running sudo apt-get install aircrack-ng...
    – eepty
    Aug 18, 2014 at 13:45
  • 2
    What makes you think this is the best way?
    – voices
    May 3, 2017 at 19:46
  • For me, today airmon-ng stopped working to go into Monitor mode for external card. Internal was going. But ifconfig/iwconfig way worked. But iwconfig way don't give me new name like wlan1mon etc. Hope this does not matter! Oct 29, 2017 at 9:20
1

Simple first make sure that you have installed drivers for your wireless adapter. Then if you want to enable monitor mode there are 2 methods to do it.

First method is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type iwconfig mode monitor and then ifconfig wlan0 up
  • type service NetworkManager restart before doing ifconfig wlan0 up.

Second way is by doing:

  • ifconfig wlan0 down
  • then airmon-ng check kill
  • then type airmon-ng start wlan0
  • then type service NetworkManager restart and ifconfig up.
0

I was facing the same issue, I disabled the network manager 1st and then able to put in monitor mode. Network manager is changing the mode back to managed mode after a while.

service NetworkManager stop

ifconfig wlp2s0 down
iwconfig wlp2s0 mode monitor
ifconfig wlp2s0 up
1
  • This works for me, but it seems to be reset after a reboot?
    – birgersp
    Oct 13, 2021 at 6:21
0

Assuming your Wi-Fi interface is wlp3s0, here's how you can set it to monitor mode:

systemctl stop NetworkManager
ip link set wlp3s0 down
iw wlp3s0 set type monitor
ip link set wlp3s0 up

Execute the commands as root or using sudo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .