Whenever I turn on the monitor mode for my wlan interface from the Capture interfaces dialog box, I can see for a moment that the text in Link layer header changes from Ethernet to 802.11 plus radiotap header, but less than a second after that, the interfaces are reloaded (i.e. the interface list got emptied and then repopulated), and the mentioned interface is spawned again with Ethernet header and monitor mode unchecked.

How can I keep the monitor mode on?


This behaviour can be observed, when your wireless interface is not in monitor mode, but e.g. in managed mode.
To fix this, on a Linux machine do e.g. the following (replace wlan0 with the name of your wireless interface):

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ifconfig wlan0 up

Now when you start wireshark you should be able to check the monitor mode box and 802.11 plus radiotap header should stay on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.