I'm unable to airodump on my wlo1 interface.

To set things up, first I set wlo1 to monitoring mode:

sudo ifconfig wlo1 down
sudo iwconfig wlo1 mode monitor
sudo ifconfig wlo1 up

After running netstat -i

enter image description here

Then I run

sudo airmon-ng check wlo1

and kill all shown processes until none remain.

Then I want to run airodump:

sudo airodump-ng wlo1

and I get the error:

ioctl(SIOCSIWMODE) failed: Device or resource busy

ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead.  Make
sure RFMON is enabled: run 'airmon-ng start wlo1 <#>'
Sysfs injection support was not found either.

So I run:

sudo airmon-ng start wlo1

and the ouput is:

Interface   Chipset     Driver

wlo1        Intel AC    iwlwifi - [phy0]
                (monitor mode enabled on mon0)

Now sudo airodump-ng wlo1 returns the same error.

When running:

sudo airodump-ng mon0

there is no network shown.

A few days ago I managed to run airodump fine on wlo1 and see the reachable networks. Back then netstat -i also showed an M flag on wlo1. Now it seems I have gone through the same steps as before but with no success. What am I doing wrong?

closed as off-topic by Polynomial, Xander, grochmal, Xiong Chiamiov, ThoriumBR Jan 2 '17 at 19:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, grochmal, Xiong Chiamiov
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    That looks like ubuntu, which makes it a question for U&L or even askubuntu. Nevertheless, ubuntu has NetworkManager enabled by default, and the NetworkManager daemon will overwrite and config you make through iwconfig. – grochmal Dec 31 '16 at 16:06
  • How about if you start it all over again and try airmon-ng , airmon-ng check , airmon-ng check kill , airmon-ng start wlo1 and then airodump-ng mon0 – defalt Dec 31 '16 at 16:45

Some systems after install aircrack-ng suite have not only airmon-ng, they have airmon-zc. Check if is your case, it depends of the aircrack version. It's suppossed that airmon-zc (Zero Chaos) is more advanced.

Airmon-zc has the same behavior on cards that airmon-ng has in systems which only have airmon-ng, I mean it changes the mode of the card but not duplicate it. An example of what I say:

  • System on which airmon-zc doesn't exist: After airmon-ng start wlan0 you'll get only one interface in monitor mode called mon0.

  • System on which there are both, airmon-ng and airmon-zc: After airmon-ng start wlan0 you'll get two interfaces. First wlan0 in managed mode and other called mon0 which will be in monitor mode. If you execute airmon-zc start wlan0 you'll get only one interface in monitor mode called wlan0mon.

Test your systems and use airmon-zc instead if you have it available. To use intentionally airmon-ng on systems which have airmon-zc is useful to perform different tasks with only one card... for example you can create an AP with hostpad (managed required) and perform a DoS attack (monitor required)... this is used in some Evil Twin attack scripts.

Regarding the NetworkManager... Until version 1.0.12 NetworkManager is not able to change the mode without disrupting your network connection. If you have a lower version than 1.0.12 you'll need to launch not only the airmon check command... you can launch airmon check kill to kill directly the conflicting processes before the airmon start. But if you have NetworkManager 1.0.12 or higher, you don't need to kill any process, no airmon check kill needed. NetworkManager can manage the mode change without problems and you will not lose your internet connection with the change.

Hope this helps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.