Wifi Adapter Monitor Mode: How To Check?

Wireless cards supporting monitor mode enable ethical hackers to listen in on other Wi-Fi conversations and even inject malicious packets into a network. Monitor mode is the ability of a WiFi card to receive any packets that are available in the reach range at its frequency. If the wireless card does not support the monitor mode, then it is practically useless for wireless pentesting. To check if your wireless adapter supports monitor mode, you can use the iw command to get a full list of all capabilities of a physical wireless card. The output of this command will show whether monitor mode is listed as a supported interface mode for your card. Alternatively, you can use tools such as Microsoft Network Monitor, Wireshark, tcpdump, or Wireless Diagnostics to check if your wireless adapter supports monitor mode.

Use Microsoft Network Monitor or Wireshark

Microsoft Network Monitor is a tool developed by Microsoft that can be used to check if your Wi-Fi adapter supports monitor mode. Here's a step-by-step guide on how to use it:

• Download and install the Microsoft Network Monitor tool.
• Reboot your system to ensure the tool detects your network cards.
• Launch the app and click on "New Capture" on the Start page.
• Go to "Capture Settings" on the top toolbar and ensure that only your Wi-Fi card is selected to listen to the packets. Uncheck all other options and click "Close".
• Click on the "Start" button to start capturing the packets.
• If you receive an error, it means your Wi-Fi card does not support monitor mode. If packets are captured successfully, your Wi-Fi card supports monitor mode.

Alternatively, you can use Wireshark, a popular network monitoring tool, to check if your Wi-Fi adapter has monitor mode. Here's how:

• Download and install Wireshark on your device.
• Open Wireshark and navigate to "Capture" -> "Interfaces" in the main menu.
• Locate your Wi-Fi interface in the list of available interfaces.
• Right-click on your Wi-Fi interface and select "Start Capture" or click the "Capture" button at the bottom of the window.
• Wireshark will start capturing packets on your Wi-Fi interface.
• If you are able to capture packets, your Wi-Fi adapter supports monitor mode. If you receive an error or cannot capture packets, it likely does not support monitor mode.

By using either Microsoft Network Monitor or Wireshark, you can determine whether your Wi-Fi adapter has monitor mode enabled or not.

Check your chipset

Checking your chipset is an important step in determining whether your Wi-Fi adapter supports monitor mode. The chipset is the CPU contained within the adapter, and different chipsets offer different capabilities.

To check your chipset on Windows, go to the Start Menu, then to Control Panel, and then to Device Manager. From there, go to "Network Adapters" and right-click on your adapter to select Properties. Go to the Details tab and select Hardware IDs in the dropdown list. The first line that shows up will give you information about your chipset.

On macOS, you can check for the Wi-Fi card's monitor mode via the terminal using the tcpdump tool.

On Ubuntu, you can find your chipset by using the following command:

Lsusb -vv

This will display all the network interfaces on your system, and you can identify your Wi-Fi interface name from there.

Once you know your chipset, you can refer to resources like Aircrack-ng's compatibility pages or the WikiDevi database to determine if your chipset supports monitor mode.

Knowing your chipset is crucial when determining the capabilities of your Wi-Fi adapter and whether it can be configured for monitor mode.

Use the command: iw list

The capabilities of your wireless hardware can be found using the command:

`iw list`

This command displays a lot of information. Pay attention to:

Supported interface modes

Supported interface modes:

• IBSS
• managed
• AP
• AP/VLAN
• monitor
• mesh point

In this example, the main entries are "monitor" and "AP".

Check for packet injection

To check if your WiFi adapter supports packet injection, you can use the following methods:

Windows

There is no direct command to check or turn on monitor mode on your WiFi card in Windows. You can use the Microsoft Network Monitor tool, which is compatible with Windows 10. After downloading and installing the tool, reboot your system and launch the app. On the "New Capture" tab, ensure only your WiFi card is listening to the packets by unchecking everything else besides WiFi in the "Capture Settings" option. Then, click "Start" to begin capturing the packets. If you get an error, your WiFi card does not support monitor mode.

MacOS

You can use the Wireless Diagnostics tool to check for the WiFi card's monitor mode. You can access this by clicking the WiFi icon in the toolbar while holding down the "option" key and selecting "Open Wireless Diagnostics" from the drop-down menu. Once the Wireless Diagnostics tool is launched, press ⌘ +⌥ +6 to open the Sniffer window, or click "Window" on the toolbar and select "Sniffer". In the Sniffer window, you can leave the Channels and Channel Width options as their default values. Click "Start" to begin scanning. Depending on your settings, you may need to enter your Mac login credentials for authentication. If the Sniffer tool runs successfully, your WiFi will be down, and you will see that it is in monitor mode when you click on the WiFi icon in the top-right corner.

Ubuntu

In Ubuntu, you first need to find the interface name of the WiFi adapter by using the following command:

Sudo ip link set dev wlp3s0 down

Replace "wlp3s0" with your WiFi interface name.

Next, turn the WiFi card to monitor mode by running the following command:

Sudo iwconfig wlp3s0 mode monitor

If your WiFi card supports monitor mode, the command will be completed successfully. To double-check, use the following command:

Sudo iwconfig

If your WiFi card is in monitor mode, it will be listed as "Mode: Monitor".

Using aireplay-ng

After putting your card into monitor mode, you can use aireplay-ng to test if your wireless network adapter can inject packets into nearby wireless networks. Make sure you are in proximity to a few WiFi networks. In a terminal window, type:

Aireplay-ng --test wlan0mon

If you get a result indicating injection is working, your network card successfully injects packets into nearby networks.

Using besside-ng

To further test the capabilities of your WiFi adapter, you can use besside-ng to attempt to capture a WPA handshake. Make sure you have a nearby network that you have permission to attack. Type the following command, replacing '-R 'Target Network'' with the name of your test network:

Besside-ng -R 'Target Network' wlan0mon

If you get an output indicating that the necessary WPA handshake information was obtained, congratulations! Your card is capable of grabbing handshakes from WPA/WPA2 networks.

Intel Wireless Adapters

For Intel wireless adapters, you can confirm that they do not support monitor mode or packet injection by opening the Command Prompt (CMD) in administrator mode and running the following command:

Netsh show wlan all

This will display all the wireless device capabilities, and you can verify that monitor mode and packet injection are not supported.

Check for access point mode

Checking if your router has an access point mode is relatively straightforward. First, you need to determine if your router has an "Operation Mode" option in its web interface. If it does, you can check if it supports access point (AP) mode. If your router does not have an "Operation Mode" option, you can use a workaround method to configure it as an access point.

To set up access point mode, you will need to connect your computer to the router via a wired or wireless connection. Once connected, enter your router's LAN IP or router URL, usually http://www.asusrouter.com, into the WEB GUI.

From here, the steps may vary slightly depending on your router model. However, you will typically need to:

• Log in to the router setting page.
• Click on "Advanced Settings" or go to the "Administration" tab.
• Select "Operation Mode" or "Choose operation mode."
• Choose "Access Point(AP) mode" and click "Save."
• Click "Automatic IP."
• Create a WiFi network name and password and click "Apply."
• Review the information and click "Next."
• Create a router account and click "Next" to complete the setup.
• Connect your AP router from its WAN or LAN port to the LAN port of the router/modem.
• Access the router settings to confirm that the current operating mode is AP mode.

It is important to note that in Access Point (AP) mode, the DHCP-assigned IP address changes. Therefore, it is recommended to install and use a Device Discovery Utility to detect the wireless router's IP address.

Frequently asked questions