How I switch to Monitor Mode in Kali Linux (and what went wrong)

I’m Kayla Sox. I run Kali on a ThinkPad X1 Carbon (Gen 7). My built-in Wi-Fi is an Intel AX200. I also carry an Alfa USB adapter (AWUS036NHA) in my bag. It’s old. It’s tough. It just works.

Why did I need monitor mode? Simple: I wanted to watch my own home network. I was testing channel use, not breaking stuff. Big note here—only do this on networks you own or have clear permission to test. It’s like checking your own locks, not your neighbor’s. You know what? That rule saves drama.
I originally turned this experience into a bigger piece for Desktop Linux Reviews—feel free to check out the full walkthrough here if you want even more detail.

My quick setup (real gear, real hiccups)

Laptop: ThinkPad X1 (Kali 2024.3)
Internal Wi-Fi: Intel AX200 (works, but not great for monitor mode)
USB Wi-Fi: Alfa AWUS036NHA (Atheros AR9271 chipset; stable in monitor mode)

If you're hunting for other USB adapters that play nicely with Kali, I found a handy roundup at Desktop Linux Reviews that breaks down chipsets and driver quirks.

I plug in the Alfa when I need less hassle. The Intel card can switch modes, but it’s picky with channels and power. For a quick refresher on the prep steps, the LabEx tutorial on preparing a wireless adapter for monitor mode in Kali is a solid resource.

Step 1: Find your Wi-Fi name

I always check the card name first. On my box, I see wlan0 for the internal card and wlan1 for the Alfa.

Command I run:

ip link show

Sample lines I see:

3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
4: wlan1: <BROADCAST,MULTICAST> ...

If I forget which is which, I peek at the chipset:

lsusb

For the Alfa, I get:

Bus 002 Device 005: ID 0cf3:9271 Atheros Communications, Inc. AR9271 802.11n

Method A (easy): airmon-ng

This is my go-to when I’m in a rush. It’s part of aircrack-ng.

Kill the apps that fight monitor mode:
```
sudo airmon-ng check kill
```
On my screen, it lists wpa_supplicant and NetworkManager. It stops them. Your Wi-Fi will drop. That’s normal, but a bit annoying.
Start monitor mode on the Alfa (mine is wlan1):
```
sudo airmon-ng start wlan1
```

What I see:

monitor mode vif enabled on [phy1]wlan1mon

Now the new name is wlan1mon. To confirm:

iw dev

I get:

Interface wlan1mon
        type monitor

Stop it when done:

sudo airmon-ng stop wlan1mon
sudo systemctl restart NetworkManager

Sometimes I also run:

nmcli radio wifi on

so my laptop gets back online.

What I like: fast and simple. What I don’t: it kills my Wi-Fi while I test. Minor pain.

Method B (manual): ip + iw

When I want control, I do it by hand. This also helps if airmon-ng gets moody.

Bring the card down:
```
sudo ip link set wlan1 down
```
Switch the type to monitor:
```
sudo iw dev wlan1 set type monitor
```
Bring it up:
```
sudo ip link set wlan1 up
```

Check:

iw dev

You should see:

Interface wlan1
        type monitor

To go back to normal (managed) mode:

sudo ip link set wlan1 down
sudo iw dev wlan1 set type managed
sudo ip link set wlan1 up

What I like: no big process killer. What I don’t: if NetworkManager pokes it, things break. So I sometimes do:

nmcli dev set wlan1 managed no

and later:

nmcli dev set wlan1 managed yes

Real fixes I had to do (because stuff broke)

Channel -1 bug (yep, that one)
- My Alfa kept saying channel -1. I set the reg domain to my country code. For me, that’s US:
```
sudo iw reg set US
```
  Then I set the channel when starting monitor mode:
```
sudo airmon-ng start wlan1 6
```
  That locked it to channel 6. No more -1.
NetworkManager keep-alive problem
- It kept pulling the card back to managed mode. This helped:
```
sudo airmon-ng check kill
```
  Or I use a softer touch:
```
nmcli radio wifi off
rfkill unblock all
```
  Then I switch to monitor mode. After, I do:
```
nmcli radio wifi on
```
Driver drama with Realtek
- My friend’s AWUS036ACH needed the 8812au driver. We used the aircrack-ng 8812au DKMS repo (yep, compile time). My NHA didn’t need that, which is why I still carry it. Less fuss. (If you run into similar headaches, check out the Kali Linux documentation on troubleshooting wireless drivers for step-by-step guidance.)
Power issues on USB hubs
- A cheap hub made the Alfa flaky. Direct port fixed it. Small thing; big time saver.

How I verify it’s really in monitor mode

I don’t guess. I check.

See the mode:
```
iw dev
```
Quick scan for frames without joining a network:
```
sudo tcpdump -i wlan1 -I -e -s 256 type mgt subtype beacon
```
I only run this on my own router at home. I watch for beacon frames. If I see BSSIDs and channels rolling by, I know it’s working.
If I’m stuck, I run:
```
dmesg | tail
```
It often tells me if the driver is mad or the card is blocked.

My take after a lot of tries

What I like
- Airmon-ng is quick. It’s like a big red button. Hit it, and you’re in monitor mode.
- The Alfa NHA is steady. It holds channel well and doesn’t overheat on me.
- Manual mode gives me control. I feel calm when I can set each step.
What bugs me
- Intel AX200 works, but it’s fussy with channels. It also flips back if NetworkManager wakes up.
- Killing network services just to test feels heavy. I need Wi-Fi for docs while I work, so I use a second adapter. Sometimes I’m even streaming media from a self-hosted stack—if you’re curious, here’s how I installed Jellyfin on Kali and kept it playing while sniffing packets.
- Realtek drivers. Enough said. They can work great, but not out of the box.

While I'm waiting for a long capture to run, I sometimes hop onto Kik to chat with other security-minded folks—if you want to expand your contact list quickly, give Kik Friender a try; it pairs you with new, active Kik users in seconds so you can swap tips (or just unwind) while the packets fly.

Sometimes my gigs take me through smaller cities—say I'm running tests near Pine Bluff, Arkansas, and want a quick way to scope out the local social scene once the laptops are closed for the night. In that case I’ll open up OneNightAffair’s Backpage Pine Bluff page where the listings are refreshed daily and include handy filters so you can zero-in on legit, nearby connections without wading through spam.

Would I recommend this flow? Yes—use an external card, keep a cheat sheet, and don’t skip the safety note. It saves you from weird states and eyebrow raises.

My small cheat sheet

Check cards:
```
ip link show
lsusb
```

Easy mode:

sudo airmon-ng check kill
sudo airmon-ng start wlan1
iw dev

Back to normal:

sudo airmon-ng stop wlan1mon
sudo systemctl restart NetworkManager

Manual mode:

sudo ip link set wlan1 down
sudo iw dev wlan1 set type monitor
sudo ip link set wlan1 up

Fix channel -1:
“`
sudo iw reg set US
sudo airmon-ng start wlan