What Is Monitor Mode?
Monitor mode allows your WiFi adapter to capture all wireless traffic in range — not just traffic addressed to your device. It’s essential for packet analysis and penetration testing.
Without monitor mode, your adapter behaves like a normal WiFi card. With it, you can see everything.
Before You Start
Check your wireless interface name:
config
Look for an entry like wlan0, wlan1, or wlan0mon. Remember this name — you’ll use it in the commands below.
Method 1: Using airmon-ng (Recommended)
This is the easiest method and works with both AR9271 and RTL8812AU.
Step 1: Kill interfering processes
sudo airmon-ng check kill
This stops NetworkManager and other services that can prevent monitor mode from working.
Step 2: Start monitor mode
sudo airmon-ng start wlan0
Replace wlan0 with your actual interface name.
You’ll see output like:
PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Atheros AR9271
(monitor mode enabled on wlan0mon)Step 3: Verify
iwconfig wlan0mon
You should see Mode:Monitor in the output.
Method 2: Using iw (Manual)
If airmon-ng doesn’t work, try this method.
sudo ip link set wlan0 down sudo iw dev wlan0 set type monitor sudo ip link set wlan0 up
Verify with:
iwconfig wlan0
Testing Packet Injection
Monitor mode lets you capture packets. Packet injection lets you send them. Test it:
sudo aireplay-ng --test wlan0mon
If you see Injection is working!, you’re ready.
If injection fails, try:
sudo ip link set wlan0mon down sudo iw dev wlan0mon set type monitor sudo ip link set wlan0mon up sudo aireplay-ng --test wlan0mon
Troubleshooting
(Use a Table block here — 2 columns)
| Issue | Solution |
|---|---|
airmon-ng says “no interface found” | Run sudo airmon-ng check kill first |
| Interface disappears after starting monitor mode | Check iwconfig — it may be renamed to wlan0mon |
| Injection test shows 0% | Disable NetworkManager: sudo systemctl stop NetworkManager |
| AR9271 works, RTL8812AU doesn’t | Reinstall RTL8812AU driver (see our RTL8812AU guide) |
Stopping Monitor Mode
When you’re done, return to normal mode:
sudo airmon-ng stop wlan0mon
Then restart NetworkManager:
sudo systemctl start NetworkManager
Conclusion
Monitor mode is the foundation of wireless pentesting. With an AR9271 or RTL8812AU adapter, enabling it takes less than a minute.
Need a compatible adapter? We sell tested units with Cash on Delivery in Pakistan.