Wireless › Module 4 › Lesson 2
Monitor Mode
Monitor mode observes frames — enable only for $LAB_SSID-filtered labs on $LAB_IFACE.
Visual · wireless_monitor_mode
Monitor mode literacy. Filter $LAB_SSID. Original Cyberlium.
Opening
Monitor mode is a microscope, not a megaphone — point it only at YOUR lab slide.
Monitor mode disables normal association and delivers 802.11 frames to capture tools. It is required for passive observation labs but illegal/misused when aimed at stranger networks without authorization. Cyberlium enables literacy: know how monitor is entered and exited on $LAB_IFACE, always paired with SSID/BSSID filter to $LAB_SSID. You will NOT leave monitor running in a café capturing everyone. Next: Driver Caveats.
1. Enter and exit cleanly
Tools may use iw, airmon-ng, or driver-specific paths to set monitor — details vary by chipset. Always return iface to managed mode after lab to avoid broken client Wi-Fi.
Document YOUR enter/exit commands for $LAB_IFACE in lab notes — without neighbor capture examples.
Command guide
Try these commands — Enter and exit cleanly
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Monitor mode — https://www.aircrack-ng.org/doku.php?id=airmon-ng airmon-ng — https://www.aircrack-ng.org/doku.php?id=airmon-ng
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install iw sudo apt install aircrack-ng
macOS: Prefer Linux lab VM for iw Prefer Kali VM — aircrack-ng needs supported adapter
Windows: Use Kali VM / WSL with iw Use Kali VM with USB passthrough adapter
═══ LINUX / macOS ═══
Command — copy this
iw list 2>/dev/null | grep -A8 'Supported interface modes' | head -12 sudo airmon-ng 2>/dev/null || echo 'airmon-ng: check YOUR adapter — OWN hardware only'
Primary tools to practice this lesson: iw, airmon-ng. Reference sites: Monitor mode (https://www.aircrack-ng.org/doku.php?id=airmon-ng); airmon-ng (https://www.aircrack-ng.org/doku.php?id=airmon-ng). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Filter before analyze
Captures include all visible frames on channel — ethics means channel choice on YOUR lab AP band and BSSID/ESSID filter $LAB_SSID during analysis.
Defenders log monitor sensors on authorized sensors; you mimic that discipline on YOUR desk.
3. Stop conditions
If capture shows unexpected ESSIDs dominating, stop and verify channel/AP — do not pivot to 'interesting' neighbors.
Next: Driver Caveats.
4. What you ship: monitor enter/exit + filter rule
Write monitor enter/exit for $LAB_IFACE. Rule: analyze only $LAB_SSID/BSSID. chmod 600.
5. What you record before the next lesson
Date. Monitor procedure on $LAB_IFACE. Filter $LAB_SSID. File t15-m04-l02-monitor-mode.txt chmod 600.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Leave monitor on in library capturing all clients. Log neighbor probe requests for fun.
Right
Document monitor hygiene tied to $LAB_SSID filter. Next: Driver Caveats.
Mission: monitor mode procedure on paper
1) Write enter/exit steps for $LAB_IFACE. 2) Add filter rule for $LAB_SSID. 3) No live neighbor capture. Never deauth from monitor.
Stuck? Ask Cyberlium AI Mentor
Channel lock to YOUR lab AP channel reduces accidental neighbor frames.
Knowledge Check
APPLY: Monitor mode on $LAB_IFACE without filter risks:
Multiple choice
Knowledge Check
APPLY: True or False: Café monitor 'because frames are public' is in Cyberlium scope.
True or False
Knowledge Check
APPLY: After lab you should:
Multiple choice