Airmon-ng

The first tool we will look at and need in nearly ever WiFi hack is airmon-ng, which converts our wireless card into a promiscuous mode wireless card. Yes, that means that our wireless card will hookup with anyone!

Well, that's almost correct. When our network card is in promiscuous mode, it means that it can see and receive all network traffic. Generally, network cards will only receive packets intended for them (as determined by the MAC address of the NIC), but with airmon-ng, it will receive all wireless traffic intended for us or not.

airmon-ng – POSIX sh script designed to turn wireless cards into monitor mode.


root@kali:~# airmon-ng --help

usage: airmon-ng <start|stop|check> <interface> [channel or frequency]
airmon-ng Usage Examples

Entering the airmon-ng command without parameters will show the interfaces status.


root@kali:~# airmon-ng

PHY Interface Driver Chipset

phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n

A number of processes can interfere with Airmon-ng. Using the check option will display any processes that might be troublesome and the check kill option will kill them for you.


root@kali:~# airmon-ng check

Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'

PID Name
465 NetworkManager
515 dhclient
1321 wpa_supplicant

root@kali:~# airmon-ng check kill

Killing these processes:

PID Name
515 dhclient
1321 wpa_supplicant

Enable monitor mode (start) on the given wireless interface (wlan0), fixed on channel 6. A new interface will be created (wlan0mon in our case), which is the interface name you will need to use in other applications.


root@kali:~# airmon-ng start wlan0 6


PHY Interface Driver Chipset

phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n

(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
(mac80211 station mode vif disabled for [phy0]wlan0)

The stop option will destroy the monitor mode interface and place the wireless interface back into managed mode.


root@kali:~# airmon-ng stop wlan0mon

PHY Interface Driver Chipset

phy0 wlan0mon ath9k_htc Atheros Communications, Inc. AR9271 802.11n

(mac80211 station mode vif enabled on [phy0]wlan0)


(mac80211 monitor mode vif disabled for [phy0]wlan0mon)