Monitor mode

Tests for monitor (promiscuous) mode, where the Wi-Fi card captures all traffic on a given channel rather than associating with a network.

Test sequence

Switch the Wi-Fi card to monitor mode.

Dump traffic on each band.

Decode the captured traffic.

PMKID sniff

Perform an RSN PMKID sniff against a real access point.

✅ Test log: Monitor mode

Tested and recorded using build 1350 at 23 Jun 2026.

Environment: Debian Trixie; made sure that NetworkManager, iw and dnsmasq are present in the system.

Switch to superuser console:

sudo su

Run this to see your Wi-Fi card name:

nmcli device status | grep wifi

in our case it is named wlxb06b11673af2:

DEVICE                   TYPE      STATE                   CONNECTION 
lo                       loopback  connected (externally)  lo         
wlxb06b11673af2          wifi      disconnected            --

Save the Wi-Fi card name to a variable:

DEV=wlxb06b11673af2

Release the radio from NetworkManager and tear down:

nmcli dev set "$DEV" managed no
ip link set "$DEV" down
iw dev "$DEV" del

Stop anything that retunes the radio:

pkill -x wpa_supplicant 2>/dev/null
rfkill unblock wifi

Set regdomain BEFORE creating the vif, while the phy is idle:

iw reg set HK

Create monitor as the ONLY vif on phy0:

iw phy phy0 interface add mon0 type monitor
ip link set mon0 up

Tune to any channel:

iw dev mon0 set channel 36

Verify:

tcpdump -i mon0 -e -n -s 256 |grep -i beacon

You should be able to see SSID beacon packets:

13:21:53.554963 22732764us tsft 6.0 Mb/s 5180 MHz 11a -66dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Chasing the 5G Nut) [6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]
13:21:53.567951 22745773us tsft 6.0 Mb/s 5180 MHz 11a -40dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Sid the Sloth) [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]
13:21:53.657399 22835161us tsft 6.0 Mb/s 5180 MHz 11a -66dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Chasing the 5G Nut) [6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]
13:21:53.670426 22848173us tsft 6.0 Mb/s 5180 MHz 11a -40dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Sid the Sloth) [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]
13:21:53.759809 22937572us tsft 6.0 Mb/s 5180 MHz 11a -66dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Chasing the 5G Nut) [6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]
13:21:53.772734 22950573us tsft 6.0 Mb/s 5180 MHz 11a -41dBm signal [bit 22] BSSID:xx:xx:xx:xx:xx:xx DA:ff:ff:ff:ff:ff:ff SA:xx:xx:xx:xx:xx:xx Beacon (Sid the Sloth) [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] ESS, PRIVACY [|802.11]

Have a question?

Our support team and an awesome community will get you an answer in a flash. Please leave your questions in English.

To ask a question or participate in discussions, you'll need to authenticate first.