airmon
airmon-ng names monitor interfaces — role literacy on $LAB_IFACE only.
Visual · wireless_airmon
airmon-ng role literacy. $LAB_IFACE monitor. $LAB_SSID scope. Original Cyberlium.
airmon-ng toggles monitor mode — it does not grant permission to capture the café.
airmon-ng in the aircrack-ng suite lists wireless interfaces and can start/stop monitor mode (often creating mon0 from $LAB_IFACE). It also reports processes that interfere with capture. Cyberlium teaches the role: prepare $LAB_IFACE for authorized observation — not enable promiscuous wardriving. Always pair with RoE filter $LAB_SSID. Next: airodump.
1. Role: monitor prep
airmon-ng start $LAB_IFACE creates a monitor interface for capture tools. stop reverses the process. check kill may stop NetworkManager — document impact on YOUR lab machine.
Defenders run similar prep on authorized sensors; attackers misuse on stranger air — you won't.
Command guide
Try these commands — Role: monitor prep
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
airmon-ng — https://www.aircrack-ng.org/doku.php?id=airmon-ng Monitor mode setup — https://www.aircrack-ng.org/doku.php
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install aircrack-ng sudo apt install iw
macOS: Prefer Kali VM — aircrack-ng needs supported adapter Prefer Linux lab VM for iw
Windows: Use Kali VM with USB passthrough adapter Use Kali VM / WSL with iw
═══ LINUX / macOS ═══
OWN adapter only — never touch neighbor interfaces
Command — copy this
sudo airmon-ng 2>/dev/null || echo 'List interfaces; start monitor on YOUR lab adapter when instructed' iw dev 2>/dev/null | grep -E 'Interface|type' || true
Primary tools to practice this lesson: airmon-ng, iw. Reference sites: airmon-ng (https://www.aircrack-ng.org/doku.php?id=airmon-ng); Monitor mode setup (https://www.aircrack-ng.org/doku.php). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Process conflicts
NetworkManager, wpa_supplicant, and dhclient can block clean monitor — note which you stopped for lab and restore after.
Never run check kill on a production laptop in café to 'clear' neighbor capture.
3. Scope reminder
airmon started ≠ authorization. SSID must be $LAB_SSID in RoE. Ship: start/stop procedure without neighbor examples. Next: airodump.
4. What you ship: airmon-ng role + start/stop outline
Describe airmon-ng purpose. Outline start/stop on $LAB_IFACE for $LAB_SSID labs. No wardrive. chmod 600.
5. What you record before the next lesson
Date. airmon-ng role notes. $LAB_IFACE procedure. File t15-m05-l01-airmon.txt chmod 600.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: airmon-ng start then airodump entire apartment. check kill on café laptop for neighbor SSIDs.
- Right: Document airmon role tied to $LAB_IFACE and $LAB_SSID. Next: airodump.
Mission: name airmon-ng's job
1) Write what airmon-ng does vs airodump-ng. 2) Outline start/stop on $LAB_IFACE. 3) Note process conflict checks. Never start monitor for neighbor SSIDs.
Stuck? Ask Cyberlium AI Mentor
Some distros prefer iw over airmon-ng — know both names; ethics stay identical.
APPLY: airmon-ng primarily:
APPLY: True or False: airmon-ng start authorizes capturing any visible SSID.
APPLY: Before monitor lab on $LAB_IFACE you verify: