What monitor mode does and why you need it

Monitor mode lets your network card listen to all wireless traffic in range, not just traffic meant for your device. In normal mode, your card ignores packets addressed to other devices. In monitor mode, it captures everything — which is why it matters for security testing on your own network.

When you switch to monitor mode, your card stops connecting to Wi-Fi networks. It becomes a passive listener instead of an active participant. This is the only way to see what data is actually moving across the air between devices and routers, which is essential if you want to understand whether your own network is leaking information or whether a device is broadcasting things it shouldn't.

Kali Linux includes the tools to do this, but the process depends on your network card's chipset and driver. Not every card supports monitor mode — older or very cheap cards often do not. If your card does support it, the steps are straightforward once you know which driver you have.

Key Takeaways

  • Monitor mode requires a compatible network card; most modern cards support it, but some older or budget models do not.
  • You must know your card's chipset and driver before you can switch modes — use iwconfig or lspci to find out.
  • The most common method uses airmon-ng to enable monitor mode and airmon-ng stop to disable it when you are done.
  • After enabling monitor mode, your card will have a new interface name (usually ending in mon) that you use for packet capture.
  • Monitor mode is legal only on networks you own or have explicit permission to test; using it on someone else's network is illegal in most jurisdictions.

Check whether your card supports monitor mode

Open a terminal and run iwconfig. This shows all your wireless interfaces and their current mode. Look for a line that says Mode:Managed or Mode:Monitor. If you see Managed, your card is in normal mode. If the output is empty or shows no wireless interfaces, your card may not be recognized.

Next, run lspci | grep -i network to see your card's chipset. Common chipsets that support monitor mode include Atheros, Broadcom (some models), Intel, and Realtek. Write down the exact chipset name — you may need it if something goes wrong.

If lspci shows nothing, try lsusb instead if you are using a USB wireless adapter. The output will list your adapter's manufacturer and model number. Search that model number online plus "monitor mode Linux" to confirm support before proceeding.

Install airmon-ng if it is not already present

Kali Linux usually includes airmon-ng as part of the aircrack-ng suite, but you can verify it is installed by typing airmon-ng in a terminal. If you see a help menu, you are ready to proceed. If you see "command not found", run sudo apt update followed by sudo apt install aircrack-ng.

airmon-ng is the standard tool for switching between managed mode and monitor mode on Linux. It handles the driver commands in the background so you do not have to interact with the driver directly. It also creates a new virtual interface for monitor mode, which keeps your original interface intact.

Enable monitor mode with airmon-ng

First, check for processes that might interfere. Run sudo airmon-ng check kill. This stops services like NetworkManager and wpa_supplicant that try to manage your wireless connection — they will prevent monitor mode from working. The output will tell you which services were stopped.

Now enable monitor mode. Run sudo airmon-ng start wlan0, replacing wlan0 with your actual interface name if it is different. You can find your interface name from the iwconfig output earlier. The command will create a new interface, usually named wlan0mon or wlan1mon.

Verify the new interface exists by running iwconfig again. You should see a new entry with Mode:Monitor. This is the interface you will use for packet capture with tools like Wireshark or tcpdump. Your original interface (wlan0) will no longer connect to networks while monitor mode is active.

Disable monitor mode when you are finished

When you are done capturing packets, switch back to managed mode so your card can connect to Wi-Fi again. Run sudo airmon-ng stop wlan0mon, using the monitor interface name from the previous step. This removes the virtual monitor interface and restores your original interface to managed mode.

If your card still will not connect to networks after disabling monitor mode, restart NetworkManager with sudo systemctl restart NetworkManager. This restarts the service that airmon-ng check kill stopped earlier. After a few seconds, your Wi-Fi networks should appear in your connection menu again.

What to do if your card does not support monitor mode

If airmon-ng start fails or creates an interface that shows Mode:Managed instead of Mode:Monitor, your card's driver does not support monitor mode. Some Broadcom and Intel cards fall into this category, especially on newer laptops.

Your options are limited. You can search for an alternative driver — for example, Broadcom cards sometimes work with the b43 driver instead of the default one — but driver installation is complex and often fails. The simpler solution is to use an external USB wireless adapter known to support monitor mode. Cards with Atheros or Realtek chipsets are widely available and inexpensive.

Before buying an adapter, search the model number plus "Kali Linux monitor mode" to confirm others have used it successfully. Avoid the cheapest no-name adapters; they often have poor driver support. Mid-range adapters from brands like TP-Link or Alfa are reliable choices.

Legal and ethical boundaries

Monitor mode itself is a neutral technical capability. Using it is legal only on networks you own or have written permission to test. Capturing traffic on someone else's network without consent is illegal in most countries, including the United States, United Kingdom, Canada, and Australia. This applies even if the network is unencrypted or has a weak password.

If you are testing a network you own, document what you are doing and when. If you are testing a network for an employer or client, get written authorization that specifies which networks, which dates, and which times you are permitted to test. Keep that authorization on file. This protects both you and the organization.

Frequently Asked Questions

Do I need to be root to enable monitor mode?

Yes. All airmon-ng commands require sudo. If you forget to type sudo, the command will fail with a permission error. You do not need to be logged in as root permanently — just prefix the command with sudo each time.

Can I use monitor mode on a built-in laptop Wi-Fi card?

Sometimes. Most modern Intel and Atheros cards support it. Broadcom cards often do not. The only way to know is to try the airmon-ng start command and check whether the new interface shows Mode:Monitor. If it does not, your card does not support it.

What is the difference between monitor mode and promiscuous mode?

Promiscuous mode works on wired networks and makes your card accept all traffic on the same physical wire. Monitor mode is wireless-specific and captures all radio frames in range. They serve the same purpose — seeing all traffic — but work on different types of networks.

Will enabling monitor mode damage my network card?

No. Monitor mode is a software setting that tells the driver to change how the card processes incoming frames. Disabling it restores normal operation. The card itself is not affected. You can switch between modes as many times as you want without any risk to the hardware.

Can I capture packets while connected to a Wi-Fi network?

Not with the same card. When you enable monitor mode, your card stops connecting to networks. If you need to stay connected to Wi-Fi while capturing traffic, you need two network cards — one in managed mode for your connection and one in monitor mode for capture. This is why external USB adapters are useful.