Install airmon-ng on Kali Linux

airmon-ng is the helper that flips a wireless interface into monitor mode so tools such as airodump-ng can capture frames for authorized Wi-Fi security labs. It ships inside the Aircrack-ng suite—not as a separate package.

This guide installs Aircrack-ng on Kali with apt (primary) or a GitHub build, verifies the tools, and walks monitor mode when a wlan interface is present. The capture host in this refresh had Ethernet only; commands and empty airmon-ng output reflect that layout.

What is airmon-ng in ethical hacking?

Wireless NICs default to managed mode: the driver delivers only frames addressed to your station. Monitor mode lets the adapter observe a wider slice of 802.11 traffic—beacons, probes, and data frames you need for lawful packet analysis with Wireshark or Aircrack-ng companions.

airmon-ng handles the mode switch and names the monitor interface (often wlan0mon). Typical workflow on Kali:

• Install the Aircrack-ng suite
• List interfaces with airmon-ng
• Stop interfering processes with airmon-ng check kill when needed
• airmon-ng start <iface> for capture
• airodump-ng on the mon interface for authorized assessments
• airmon-ng stop <mon_iface> to return to managed mode

Managed mode vs monitor mode

Monitor mode does not grant magic access to encrypted payloads—you still need keys or handshake capture for WPA tests. It does let you see who is transmitting and which networks are in range.

Aircrack-ng tools you install together

The aircrack-ng package bundles the suite. Common tools:

airmon-ng is the first step when your lab card supports monitor mode on Kali.

Choose an install method

Use apt unless you deliberately need a newer git build.

Install Aircrack-ng with apt on Kali

Refresh indexes and install the suite. Package installs use apt command on Kali.

sudo apt update

sudo apt install -y aircrack-ng

Sample output:

Reading package lists...
Building dependency tree...
Reading state information...
aircrack-ng is already the newest version (1:1.7+git20230807.4bf83f1a-3).
Summary:
  Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 815

When the package is already present, apt reports the current NEVRA and skips reinstall.

Confirm CPU features Aircrack-ng can use for cracking workloads:

aircrack-ng -u

Sample output:

Vendor          = Intel
Model           = Intel(R) Core(TM) Ultra 5 135U
Features        = MMX,SSE,SSE2,SSE3,SSSE3,SSE4.1,SSE4.2,AES-NI,AVX,AVX2
Logical CPUs    = 2
SIMD size       = 8 (256 bit)
SIMD size in use= 8 (256 bit)

AES-NI and AVX2 lines mean WPA cracking can use hardware-accelerated paths when you move on to capture analysis.

List wireless PHYs and drivers:

sudo airmon-ng

Sample output on an Ethernet-only VM (no USB Wi-Fi):

PHY	Interface	Driver		Chipset

An empty table means Linux sees no wireless PHY—attach a compatible USB adapter before monitor mode steps. When hardware is present, you get rows with wlan0, driver name, and chipset.

Build Aircrack-ng from GitHub on Kali

Compile when you need upstream HEAD or experimental scripts. Install build dependencies first:

sudo apt install -y autoconf automake libpcre3-dev libnl-3-dev libsqlite3-dev libssl-dev ethtool build-essential g++ libnl-genl-3-dev libgcrypt20-dev libtool pkg-config git

Clone the repository:

git clone https://github.com/aircrack-ng/aircrack-ng.git "${HOME}/aircrack-ng"

cd "${HOME}/aircrack-ng"

Regenerate build files and configure with experimental options:

autoreconf -i

./configure --with-experimental --with-ext-scripts

Sample output:

Features:
    CMAC Support:                yes
    Experimental Extra Scripts:  yes
    Experimental Features:       yes

Build binaries (this can take several minutes on a laptop):

make -j"$(nproc)"

Sample output:

CCLD     airserv-ng
  CCLD     airtun-ng
  CXXLD    aircrack-ng
  CCLD     airdecap-ng
  CCLD     packetforge-ng
  CCLD     ivstools
  CCLD     makeivs-ng

Install only when you intend to replace the apt binaries:

sudo make install

Skip make install if you want to keep the distribution package as your default and use the git build from src/ for testing.

Update the Aircrack-ng OUI database

airodump-ng uses IEEE OUI files to label vendor names in output. Refresh them after install:

sudo airodump-ng-oui-update

Sample output:

Updating /var/lib/ieee-data//iab.csv
	Downloading https://standards-oui.ieee.org/iab/iab.csv to /var/lib/ieee-data//iab.csv
	/var/lib/ieee-data//iab.csv updated.

The script downloads current IEEE assignment files into /var/lib/ieee-data/.

Kali lab setup for monitor mode

Set interface variables when a USB Wi-Fi adapter appears as wlan0:

IFACE=wlan0
MON_IFACE="${IFACE}mon"

List all network interfaces:

ip -br link

Sample output on the Ethernet-only capture host:

lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
eth0             UP             08:00:27:5a:87:bc <BROADCAST,MULTICAST,UP,LOWER_UP>
eth1             UP             08:00:27:7d:c5:a5 <BROADCAST,MULTICAST,UP,LOWER_UP>

No wlan entry confirms you need external Wi-Fi hardware for monitor mode on that VM.

Check processes that fight monitor mode (NetworkManager, wpa_supplicant):

sudo airmon-ng check

Sample output:

Found 1 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode

    PID Name
    567 NetworkManager

When you see NetworkManager in the list, run sudo airmon-ng check kill before start on a real wlan interface.

Enable monitor mode with airmon-ng

With a wireless interface listed by airmon-ng, start monitor mode on channel 6 (adjust as needed):

sudo airmon-ng start "${IFACE}" 6

On success, the tool renames the interface—wlan0 becomes wlan0mon on most drivers. Verify with:

iw dev

You should see type monitor on the mon interface. Then run sudo airodump-ng "${MON_IFACE}" for authorized capture in your lab.

This refresh could not run start because no PHY was present. On hardware with wlan0, expect summary lines naming the new monitor interface before you open airodump-ng.

Stop monitor mode with airmon-ng

Return the card to managed mode when the lab ends:

sudo airmon-ng stop "${MON_IFACE}"

The monitor interface name disappears and managed mode returns—wlan0 is available for normal association again. Restart NetworkManager if you used check kill:

sudo systemctl start NetworkManager

airmon-ng troubleshooting

References

• Aircrack-ng
• airmon-ng documentation
• Aircrack-ng GitHub repository

Summary

You installed or verified the Aircrack-ng suite on Kali, checked SIMD support with aircrack-ng -u, and listed wireless PHYs with sudo airmon-ng. The apt path is the default for most labs; the GitHub build adds experimental tooling when you run autoreconf, configure, and make yourself.

Monitor mode requires real Wi-Fi hardware—Ethernet-only VMs show an empty PHY table until you add a USB dongle that supports monitor mode in Linux. Use airmon-ng check before start, capture with airodump-ng on the mon interface during authorized tests, and airmon-ng stop when you finish.

Next steps for Wi-Fi coursework: hack Wi-Fi password after you have handshake captures, and wire the adapter into your pentest lab setup on an isolated segment.