How to Change to Monitor Mode in Kali Linux

Kali Linux is built for security professionals and ethical hackers, and one of its most-used features is the ability to switch a wireless network adapter into monitor mode. If you've run into this term and aren't sure what it means — or you know what it means but can't get it working — this guide walks through the concept, the commands, and the variables that determine whether your setup cooperates.

What Monitor Mode Actually Does

By default, a Wi-Fi adapter operates in managed mode. In this state, it only processes packets addressed to your device — everything else gets ignored at the hardware level.

Monitor mode changes that behavior entirely. The adapter listens to all wireless traffic in range, regardless of who it's addressed to. This is essential for tasks like:

• Wireless network auditing
• Packet capture and analysis
• Testing WPA/WPA2 handshake capture
• Running tools like airodump-ng, Wireshark, or kismet

Without monitor mode, those tools either won't launch or won't capture anything useful.

The Core Requirement: A Compatible Wireless Adapter

Before touching a single command, your adapter needs to support monitor mode. Not all do.

Many built-in laptop Wi-Fi cards — especially on consumer hardware — don't support monitor mode, or their Linux drivers block it. This is the single biggest reason people run into errors.

Common chipsets known to work well in Kali Linux include those from Atheros, Ralink, and Realtek (specific models vary). USB adapters marketed for penetration testing are often a safer bet because they're sold specifically for this use case.

You can check your adapter's current capabilities with:

iw list 

Look for a section labeled Supported interface modes. If monitor appears in that list, you're good to go.

🛠️ Method 1: Using airmon-ng (Most Common)

The airmon-ng tool from the Aircrack-ng suite is the standard way to enable monitor mode in Kali Linux.

Step 1 — Identify your wireless interface:

iwconfig 

Your adapter will typically show as wlan0, wlan1, or similar.

Step 2 — Stop processes that may interfere:

sudo airmon-ng check kill 

This stops Network Manager and other processes that can conflict with monitor mode. Note that this will disconnect you from any active Wi-Fi connection.

Step 3 — Enable monitor mode:

sudo airmon-ng start wlan0 

Replace wlan0 with your actual interface name. If successful, Kali will typically rename the interface to wlan0mon.

Step 4 — Verify it worked:

iwconfig wlan0mon 

Look for Mode:Monitor in the output.

To disable monitor mode and return to managed mode:

sudo airmon-ng stop wlan0mon sudo service NetworkManager restart 

Method 2: Using iw and ip Commands Manually

Some users prefer a manual approach, which gives more control and doesn't rename the interface.

sudo ip link set wlan0 down sudo iw wlan0 set monitor none sudo ip link set wlan0 up 

Verify with:

iwconfig wlan0 

This method leaves the interface named wlan0 and doesn't kill background processes automatically — meaning you may still get interference from Network Manager unless you stop it manually:

sudo systemctl stop NetworkManager 

Method 3: Using iwconfig (Older, Still Works on Some Systems)

sudo ifconfig wlan0 down sudo iwconfig wlan0 mode monitor sudo ifconfig wlan0 up 

This is the older approach and may not work reliably on all Kali versions or drivers, but it's worth knowing if the other methods produce errors.

Comparing the Three Methods

Why Things Go Wrong ⚠️

Even with a compatible adapter, monitor mode can fail or behave unexpectedly. Common causes:

• Driver issues — The kernel driver for your chipset may not fully support monitor mode. Checking for updated drivers or using DKMS-based drivers (like rtl8812au for certain Realtek adapters) can resolve this.
• Virtualized environments — Running Kali in VirtualBox or VMware adds a layer of complexity. USB pass-through is required to give the VM control of a physical adapter, and not all hypervisor configurations handle this cleanly.
• Network Manager interference — Even after check kill, Network Manager may restart automatically depending on your Kali configuration.
• Channel locking — Some tools require you to lock your adapter to a specific channel after enabling monitor mode. airodump-ng handles this, but manual setups sometimes need iwconfig wlan0mon channel 6 or equivalent.

The Variables That Change Your Experience

Which method works best — and whether monitor mode works at all — depends on factors specific to your setup:

• Adapter chipset and driver version in your Kali installation
• Whether you're running Kali natively or in a VM
• Kali Linux version (rolling updates occasionally affect driver behavior)
• Whether you need frequency band support — 2.4GHz vs 5GHz monitor mode isn't equally supported across all adapters
• What you're trying to capture — packet sniffing vs active injection have different adapter requirements

A setup that works perfectly for one user capturing 2.4GHz traffic may not support 5GHz monitoring or packet injection at all. The specific combination of your hardware, driver, and Kali version is what ultimately defines the boundaries of what's possible for you.