0

I wanted to set up promiscuous Wi-Fi monitoring into Wireshark. Tried to do it like I used to with iwconfig, but this system sets me back to managed as soon as I bring the interface back up. I see online posts saying iw can add a monitor interface alongside the managed connection, so you can keep your internet alive while monitoring. Would be great, but:

[loren@Gazp9 ~]$ iw dev wlp3s0 interface add mon0 type monitor
command failed: Operation not permitted (-1)
[loren@Gazp9 ~]$ iw phy wlp3s0 interface add mon0 type monitor
command failed: No such file or directory (-2)
[loren@Gazp9 ~]$ iw phy
Wiphy phy0
[loren@Gazp9 ~]$ iw phy phy0 interface add mon0 type monitor
command failed: Operation not permitted (-1)

(That's Antergos 4.19.8-arch1-1-ARCH, if it matters.)

So I dug deeper, including Deciphering the output of iw list valid interface combinations here. But I'm still not sure if this means there is no hope of adding the monitor interface. Here are excerpts from my "iw phy" command response:

phy0    Supported interface modes:
             * IBSS
             * managed
             * AP
             * AP/VLAN
             * monitor
             * P2P-client
             * P2P-GO
             * P2P-device

    Supported commands:
             * new_interface
    (nothing about add interface)

    software interface modes (can always be added):
             * AP/VLAN
             * monitor
    valid interface combinations:
             * #{ managed } <= 1, #{ AP, P2P-client, P2P-GO } <= 1, #{ P2P-device } <= 1,
               total <= 3, #channels <= 2

Looks like I can have one monitor for sure. [And after the suggestion here to add sudo to my interface add command, I actually added the monitor interface successfully alongside my managed interface.]

But I'm still curious about:

Why isn't "add interface" listed as a supported command? I've seen it work...

What is the "software interface" monitor that can "always" be added? Isn't my "interface add" connection just software?

Maybe those two questions answer each other? If so, what is a "non-software interface"? Can I magically add actual hardware to my system by typing commands?

Why doesn't "valid interface combinations" list "monitor" at all? I have it working combined with "managed".

Maybe the response to "iw phy" is created by the people who made my Chinese hardware?

And, why in the wiki at https://wireless.wiki.kernel.org/en/users/documentation/iw do only

sudo iw dev wlan1 station get

and

sudo iw dev wlan0 set power_save on

show the use of sudo? None of the "add" commands show it:

iw dev wlan0 interface add fish0 type monitor flags none

But this is intellectual curiosity. I'm happy to have a working monitor and get on with the real project.

  • 1
    Try to add the monitor interface as root, i.e setup sudo and use it. – dirkt Jan 15 at 7:02
  • Many thanks to dirkt! sudo iw dev wlp3s0 interface add mon0 type monitor worked immediately - mon0 existed, but Wireshark said it wasn't up. sudo ifconfig mon0 up made it connectable, and I see a torrent of WLAN packets now in Wireshark. While my usual Wi-Fi connection still works. Seems odd that I saw so many web hits showing iw set commands working without root. Even the official wiki only shows set power_save with sudo, all the other commands don't show it. – LorenAmelang Jan 17 at 2:54
  • Some iw commands actually work as non-root, but not creating a new interface (for obvious reasons). Relevant xkcd. – dirkt Jan 17 at 6:31
  • Please edit your question to reflect the current state of your inquiry, showing what you have learned (i.e., what you posted as a comment, but not including the “thanks”) and what you still want to know. Do you still have a question? Your comment makes it kind-of sort-of look like you have resolved your problem. If so, please say so explicitly. – G-Man Jan 19 at 1:29
0

(As the asker didn't write his own answer:)

Add the monitor interface as root, i.e setup sudo and use it.

Judging from the comment, this seems to have worked:

sudo iw dev wlp3s0 interface add mon0 type monitor 

worked immediately - mon0 existed, but Wireshark said it wasn't up.

sudo ifconfig mon0 up 

made it connectable, and I see a torrent of WLAN packets now in Wireshark.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.