While the interface name can be changed, "phy" is a unique and immutable identifier that a mac80211 interface gets until a reboot or each time a Wi-Fi adapter is plugged in and its driver is loaded. Therefore, plugging and unplugging the same Wi-Fi adapter will result in incremented "phy" numbers.
Airmon-ng check
It's important to identify and terminate processes like Newtork Manager which can interfere with the tools in the Aircrack-ng suite. The check parameters checks for and lists these processes:
kali@kali:~$ sudo airmon-ng check
Found 3 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
1885 NetworkManager
1955 wpa_supplicant
2015 dhclient
Using airmon-ng with the check kill paremeters will try to gracefully stop known services and kill the rest of the processes:
kali@kali:~$ sudo airmon-ng check kill
Killing these processes:
PID Name
1955 wpa_supplicant
2015 dhclient
If Internet access is needed, it should be configured manually after putting the interface in monitor mode using tools such as dhclient and/or wpa_supplicant on another interface. If access point mode is required, it should be manually configured as well using hostapd.
Airmon-ng start
Placing our wlan0 interface in monitor mode:
kali@kali:~$ sudo airmon-ng start wlan0
PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n
(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
(mac80211 station mode vif disabled for [phy0]wlan0)
Starting monitor mode on a specific channel:
kali@kali:~$ sudo airmon-ng start wlan0 3
PHY Interface Driver Chipset
phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n
(mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
(mac80211 station mode vif disabled for [phy0]wlan0)
Running iw to show our monitor mode interface's information:
kali@kali:~$ sudo iw dev wlan0mon info
Interface wlan0mon
ifindex 6
wdev 0x4
addr 00:13:a7:12:3c:5b
type monitor
wiphy 0
channel 3 (2422 MHz), width: 20 MHz (no HT), center1: 2422 MHz
txpower 20.00 dBm
We can also use iwconfig however it is deprecated:
kali@kali:~$ sudo iwconfig wlan0mon
wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.422 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off
The --verbose option outputs release information from lsb_release -a, kernel information from uname -a, virtual machine detection, and details about connected interfaces.
kali@kali:~$ sudo airmon-ng --verbose
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2019.3
Codename: kali-rolling
Linux kali 4.19.0-kali5-amd64 #1 SMP Debian 4.19.37-6kali1 (2019-07-22) x86_64 GNU/Linux
Detected VM using lspci
This appears to be a VMware Virtual Machine
If your system supports VT-d, it may be possible to use PCI devices
If your system does not support VT-d, you can only use USB wifi cards
K indicates driver is from 4.19.0-kali5-amd64
V indicates driver comes directly from the vendor, almost certainly a bad thing
S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE
? indicates we do not know where the driver comes from... report this
X[PHY]Interface Driver[Stack]-FirmwareRev Chipset Extended Info
K[phy0]wlan0 ath9k_htc[mac80211]-1.4 Qualcomm Atheros Communications AR9271 802.11n mode managed
In comparison, the output with --debug provides slightly more details derived from system commands:
kali@kali:~$ sudo airmon-ng --debug
/bin/sh -> /usr/bin/dash
SHELL is GNU bash, version 5.0.3(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2019.3
Codename: kali-rolling
Linux kali 4.19.0-kali5-amd64 #1 SMP Debian 4.19.37-6kali1 (2019-07-22) x86_64 GNU/Linux
Detected VM using lspci
This appears to be a VMware Virtual Machine
If your system supports VT-d, it may be possible to use PCI devices
If your system does not support VT-d, you can only use USB wifi cards
K indicates driver is from 4.19.0-kali5-amd64
V indicates driver comes directly from the vendor, almost certainly a bad thing
S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE
? indicates we do not know where the driver comes from... report this
X[PHY]Interface Driver[Stack]-FirmwareRev Chipset Extended Info
getStack mac80211
getBus usb
getdriver() ath9k_htc
getchipset() Qualcomm Atheros Communications AR9271 802.11n
BUS = usb
BUSINFO = 0CF3:9271
DEVICEID =
getFrom() K
getFirmware 1.4
K[phy0]wlan0 ath9k_htc[mac80211]-1.4 Qualcomm Atheros Communications AR9271 802.11n mode managed
Airmon-ng stop
Disabling monitor mode with the stop parameter:
kali@kali:~$ sudo airmon-ng stop wlan0mon
PHY Interface Driver Chipset
phy0 wlan0mon ath9k_htc Atheros Communications, Inc. AR9271 802.11n
(mac80211 station mode vif enabled on [phy0]wlan0)
(mac80211 monitor mode vif disabled for [phy0]wlan0mon)
Airodump-ng
Airodump-ng Usage
Run airodump-ng without parameters to display the options. The options most often used are for saving to a file, filtering by BSSID, and capturing only on a specific channel:
Option
Description
-w prefix
Saves the capture dump to the specified filename
--bssid BSSID
Filters Airodump-ng to only capture the specified BSSID
-c channel(s)
Forces Airodump-ng to only capture the specified channel(s)
Sniffing with Airodump-ng
Initiating our first sniffing session, only capturing on channel 2:
The signal level reported by the card, which will get higher as we get closer to the AP or station
RXQ
Receive Quality as measured by the percentage of frames successfully received over the last 10 seconds
Beacons
Number of announcement frames sent by the AP
# Data
Number of captured data packets (if WEP, this is the unique IV count), including data broadcast packets
#/s
Number of data packets per second measured over the last 10 seconds
CH
Channel number taken from beacon frames. Note that sometimes frames from other channels are captured due to overlapping channels
MB
Maximum speed supported by the AP. 11=802.11b, 22=802.11b+, up to 54 is 802.11g and anything higher is 802.11n or 802.11ac
ENC
Encryption algorithm in use. OPN=no encryption, "WEP?"=WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP=static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present. WPA3 and OWE both require CCMP
CIPHER
The cipher detected: CCMP, WRAP, TKIP, WEP, WEP40, or WEP104
AUTH
The authentication protocol used. One of MGT (WPA/WPA2/WPA3 Enterprise), SKA (WEP shared key), PSK (WPA/WPA2/WPA3 pre shared key), or OPN (WEP open authentication)
ESSID
The so-called SSID, which can be empty if the SSID is hidden
Airodump-ng Fields in the bottom section
Field
Description
BSSID
The MAC address of the AP
STATION
The MAC address of each associated station
Rate
Station's receive rate, followed by transmit rate
Lost
Number of data frames lost over the last 10 seconds based on the sequence number
Packets
Number of data packets sent by the client
Probes
The ESSIDs probed by the client
Precision Sniffing
Specifying the channel, bssid, and the output file we'd like when performing a dump:
By default, using the -w option will output to PCAP, CSV, Kismet legacy CSV, Kismet legacy NetXML, and Log CSV. GPS coordinates can be included with the -g option and the Initialization Vectors with the --ivs option (only useful for WEP cracking).
We can limit file formats generated by using the --output-format option followed by a comma separated list of file formats.
Ensure you're using the correct monitor mode interface.
Aireplay-ng Hangs with No Output
Confirm wireless card is on the same channel as the AP.
interfacexmon is on channel Y, but the AP uses channel Z
Confirm monitor mode was started in the correct channel.
Check for network processes/services causing interference.
Aireplay-ng General Troubleshooting Tips
Look for deauthentication or disassociation messages during injection.
Ensure wireless card driver is properly patched and installed.
Be physically close enough to the AP.
Verify monitor mode.
Verify channel matches the AP.
Aircrack-ng
Aircrack-ng is CPU intensive and will fully use all the CPUs. Laptops typically aren't built for constant CPU load for long periods of time. This can raise the temperature of the CPU significantly. If the laptop's cooling system is inadequate, the CPU will be throttled, which will reduce performance. Sometimes, the cooling system can't even handle throttled CPUs, and the CPU may end up suddenly turning off to protect itself and other components from damage. Adding an active cooling pad might help. We can also monitor the temperatures. In Linux we'll do this with the lm-sensors command.
Aircrack-ng Benchmark
Running benchmark mode:
kali@kali:~$ aircrack-ng -S
11117.918 k/s
Airdecap-ng
Removing Wireless Headers
Removing wireless headers from an unencrypted capture file. Using -b to specify the BSSID and setting the AP MAC to keep:
kali@kali:~$ sudo airdecap-ng -b 34:08:04:09:3D:38 opennet-01.cap
Total number of stations seen 0
Total number of packets read 307
Total number of WEP data packets 0
Total number of WPA data packets 0
Number of plaintext data packets 0
Number of decrypted WEP packets 0
Number of corrupted WEP packets 0
Number of decrypted WPA packets 0
Number of bad TKIP (WPA) packets 0
Number of bad CCMP (WPA) packets 0
Airdecap-ng saved the data packets linked to 34:08:04:09:3D:38 into a new capture file, with -dec (decrypted) appended to the original filename: opennet-01-dec.cap.
Airgraph-ng
Clients to AP Relationship Graph
The Clients to AP Relationship (CAPR) graph type displays the relationships between clients and APs. Running airgraph-ng with the -o option to output to a file name, the -i option to input an airodump-ng .csv file, and -g to define a CAPR graph:
kali@kali:~$ mkdir support
kali@kali:~$ cd support
kali@kali:~$ wget http://standards-oui.ieee.org/oui.txt
kali@kali:~$ cd ..
kali@kali:~$ airgraph-ng -o Picture1_png -i dump-01.csv -g CAPR
Clients Probe Graph
The Client Probe Graph (CPG) displays relationships between wireless clients and probed networks. Creating this graph with a airodump-ng .csv file, and specifiying the graph type as CPG with -g CPG:
