Skip to content

Airmon-ng Cheat Sheet

airmon-ng is part of the Aircrack-ng suite and is used to enable, disable, and manage monitor mode on wireless interfaces. It is a core utility for Wi-Fi penetration testing workflows.

List Wireless Interfaces

airmon-ng

Displays: - Interface name (e.g. wlan0) - Driver - Chipset

Enable Monitor Mode

airmon-ng start wlan0

Common results: - wlan0 → wlan0mon - wlan0 → mon0 (older setups)

Tip

Always use the monitor interface created by airmon-ng.

Enable Monitor Mode on a Specific Channel

airmon-ng start wlan0 6

Locks the interface to channel 6.

Check for Interfering Processes

airmon-ng check

Kill Interfering Processes

airmon-ng check kill

Common conflicting services: - NetworkManager - wpa_supplicant - dhclient

Disable Monitor Mode

airmon-ng stop wlan0mon

Restores the interface to managed mode.

Verify Interface Mode

iwconfig

Monitor mode interfaces will show: 

Mode:Monitor

Typical Workflow

airmon-ng
airmon-ng check kill
airmon-ng start wlan0
airodump-ng wlan0mon

Troubleshooting

Monitor mode not enabled
  • Ensure your wireless card supports monitor mode
  • Ensure correct driver is installed
  • Disable NetworkManager if needed
Interface disappears

Some drivers rename interfaces dynamically. Re-check with airmon-ng.

  • airodump-ng – packet capture
  • aireplay-ng – packet injection
  • aircrack-ng – key cracking

Use Cases

  • Wi-Fi reconnaissance
  • Packet capture
  • Deauthentication attacks
  • Rogue access point setup