$sudo ifconfig wlan0 down
$sudo iwconfig wlan0 mode monitor/managed
$ iwconfig wlan0
$sudo ifconfig wlan0 up
$ sudo ifconfig wlan0 down
$ sudo iwconfig wlan0 mode managed
$ sudo ifconfig wlan0 up
$ iwconfig wlan0
$ sudo ifconfig wlan0 down
$ sudo iwconfig wlan0 mode managed
$ sudo ifconfig wlan0 up
$ iwconfig wlan0
iw
First be aware that iw distinguishes between wireless LAN hardware devices (the physical layer, referred to as phy) and the network interface configured to use that hardware (e.g. wlan0, similar to an Ethernet eth0 interface). To see the list of devices, and interfaces for each device:
$ iw dev
phy#0
Interface wlan0
ifindex 3
type managed
In my case (and most likely for most typical computers) the hardware is phy0 and my network interface is wlan0. You can see detailed information about the hardware using:
$ iw phy phy0 info
Wiphy phy0
Band 1:
Capabilities: 0x172
HT20/HT40
…
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* WDS
* monitor
* mesh point
software interface modes (can always be added):
* AP/VLAN
* monitor
…
Of importance for the next step is the supported/software interface modes should include entry for “monitor”, meaning your hardware supports monitor mode. If there is no “monitor” entry, then you will not be able to capture other peoples data using the next steps.
Capturing in Monitor Mode
If your hardware device supports monitor mode then you must add a monitor interface called mon0.
$ sudo iw phy phy0 interface add mon0 type monitor
You can check that it is added:
$ iw dev
phy#0
Interface mon0
ifindex 4
type monitor
Interface wlan0
ifindex 3
type managed
We will capture with the mon0 interface, so you can delete the normal wlan0 interface:
$ sudo iw dev wlan0 del
Now enable the mon0 interface using ifconfig:
$ sudo ifconfig mon0 up
Before capturing, specify the wireless LAN frequency you want to capture on. You should choose the frequency based on the channels used by neighbouring access points. The frequency is given in MHz, e.g.\ channel 6 is 2437.
$ sudo iw dev mon0 set freq 2437
To check that your interface is in monitor mode and using the correct frequency you can use iwconfig:
$ iwconfig mon0
mon0 IEEE 802.11bgn Mode:Monitor Frequency:2.437 GHz Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Power Management:on
Now you can capture, e.g. using tcpdump:
$ sudo tcpdump -i mon0 -n -w wireless.cap
Ctrl-C to stop the capture, then view with Wireshark. To display select wireless LAN frames in Wireshark use the wlan and wlan_mgt filters. (My brief summary of Wireshark and WLAN filters)
Returning to Managed Mode
If after monitoring you want to revert the changes and continue using the wlan0 interface in managed mode (e.g. connect to an AP), then delete the mon0 interface and add the wlan0 interface:
$ sudo iw dev mon0 del
$ sudo iw phy phy0 interface add wlan0 type managed
$ iw dev
phy#0
Interface wlan0
ifindex 5
type managed
$ iwconfig wlan0
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Power Management:on
Mode:Managed
Operating mode for the device.
Depending on your card, you may select one of these:
Ad-Hoc (network composed of only one cell and without Access Point)
Managed (node connects to a network composed of many Access Points, with roaming)
Master (the node is the synchronisation master or acts as an Access Point)
Repeater (the node forwards packets between other wireless nodes)
Secondary (the node acts as a backup master/repeater)
Monitor (the node is not associated with any cell and passively monitor all packets on the frequency)
Auto.