Unable to capture authentication frames in monitor mode in linux using Wireshark. I am able to see probe request & response, Acknowledgement, Beacon, cts, rts frames.

Followed below steps and also using airmon-ng but after enabling monitor mode network manager is missing from the task bar but I wanted to connect to my access point in monitor mode to capture authentication frames. Kindly help

Check monitor mode support:

sudo iw list | grep -A 10 "Supported interface modes

Enable monitor mode:

sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

Stop monitor mode and reconnect to Wi-Fi:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode managed
sudo ifconfig wlan0 up
sudo systemctl restart NetworkManager
  • Have you set your capture interface to the correct channel? This can be done with iw or with the wireless toolbar in Wireshark. Commented May 23 at 19:47


You must log in to answer this question.

Browse other questions tagged .