Table of Contents
Description
This script can be used to enable monitor mode on wireless interfaces. It may also be used to kill network managers, or go back from monitor mode to managed mode. Entering the airmon-ng command without parameters will show the interfaces status.
Usage
usage: airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill>
Where:
-
<start|stop> indicates if you wish to start or stop the interface. (Mandatory)
-
<interface> specifies the interface. (Mandatory)
-
[channel] optionally set the card to a specific channel.
-
<check|check kill> “check” will show any processes that might interfere with the aircrack-ng suite. It is strongly recommended that these processes be eliminated prior to using the aircrack-ng suite. “check kill” will check and kill off processes that might interfere with the aircrack-ng suite. For “check kill” see
Usage Examples
Typical Uses
Check status and/or listing wireless interfaces
~# airmon-ng PHY Interface Driver Chipset phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n
Checking for interfering processes
When putting a card into monitor mode, it will automatically check for interfering processes. It can also be done manually by running the following command:
~# airmon-ng check Found 5 processes that could cause trouble. If airodump-ng, aireplay-ng or airtun-ng stops working after a short period of time, you may want to kill (some of) them! PID Name 718 NetworkManager 870 dhclient 1104 avahi-daemon 1105 avahi-daemon 1115 wpa_supplicant
Killing interfering processes
This command stops network managers then kill interfering processes left:
~# airmon-ng check kill Killing these processes: PID Name 870 dhclient 1115 wpa_supplicant
Enable monitor mode
Note: It is very important to kill the network managers before putting a card in monitor mode!
~# airmon-ng start wlan0 Found 5 processes that could cause trouble. If airodump-ng, aireplay-ng or airtun-ng stops working after a short period of time, you may want to kill (some of) them! PID Name 718 NetworkManager 870 dhclient 1104 avahi-daemon 1105 avahi-daemon 1115 wpa_supplicant PHY Interface Driver Chipset phy0 wlan0 ath9k_htc Atheros Communications, Inc. AR9271 802.11n (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon) (mac80211 station mode vif disabled for [phy0]wlan0)
As you can see, it created a monitor mode interface called wlan0mon and it notified there are a few process that will interfere with the tools.
Disable monitor mode
~# airmon-ng stop wlan0mon PHY Interface Driver Chipset phy0 wlan0mon ath9k_htc Atheros Communications, Inc. AR9271 802.11n (mac80211 station mode vif enabled on [phy0]wlan0) (mac80211 monitor mode vif disabled for [phy0]wlan0mon)
Don’t forget to restart the network manager. It is usually done with the following command:
service network-manager start
Madwifi-ng driver monitor mode
This describes how to put your interface into monitor mode. After starting your computer, enter “iwconfig” to show you the current status of the wireless interfaces. It likely looks similar the following output.
Enter “iwconfig”:
lo no wireless extensions.
eth0 no wireless extensions.
wifi0 no wireless extensions.
ath0 IEEE 802.11b ESSID:"" Nickname:""
Mode:Managed Channel:0 Access Point: Not-Associated
Bit Rate:0 kb/s Tx-Power:0 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
If you want to use ath0 (which is already used):
airmon-ng stop ath0
And the system will respond:
Interface Chipset Driver wifi0 Atheros madwifi-ng ath0 Atheros madwifi-ng VAP (parent: wifi0) (VAP destroyed)
Now, if you do “iwconfig”:
System responds:
lo no wireless extensions. eth0 no wireless extensions. wifi0 no wireless extensions.
You can see ath0 is gone.
To put wifi0 in monitor mode:
airmon-ng start wifi0
System responds:
Interface Chipset Driver wifi0 Atheros madwifi-ng ath0 Atheros madwifi-ng VAP (parent: wifi0) (monitor mode enabled)
Now enter “iwconfig”
System responds:
lo no wireless extensions.
eth0 no wireless extensions.
wifi0 no wireless extensions.
ath0 IEEE 802.11g ESSID:""
Mode:Monitor Frequency:2.452 GHz Access Point: 00:0F:B5:88:AC:82
Bit Rate=2 Mb/s Tx-Power:18 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=0/94 Signal level=-96 dBm Noise level=-96 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0
You can see ath0 is in monitor mode. Also make sure the essid, nickname and encryption have not been set. The access point shows the MAC address of the card. The MAC address of the card is only shown when using the madwifi-ng driver. Other drivers do not show the MAC address of the card.
If ath1/ath2 etc. is running then stop them first prior to all the commands above:
airmon-ng stop ath1
You can set the channel number by adding it to the end: airmon-ng start wifi0 9
Usage Tips
Confirming the Card is in Monitor Mode
To confirm that the card is in monitor mode, run the command “iwconfig”. You can then confirm the mode is “monitor” and the interface name.
For the madwifi-ng driver, the access point field from iwconfig shows your the MAC address of the wireless card.
Determining the Current Channel
To determine the current channel, enter “iwlist <interface name> channel”. If you will be working with a specific access point, then the current channel of the card should match that of the AP. In this case, it is a good idea to include the channel number when running the initial airmon-ng command.
How Do I Put My Card Back into Managed Mode?
It depends on which driver you are using. For all drivers except madwifi-ng:
airmon-ng stop <interface name>
For madwifi-ng, first stop ALL interfaces:
airmon-ng stop athX
Where X is 0, 1, 2 etc. Do a stop for each interface that iwconfig lists.
Then:
wlanconfig ath create wlandev wifi0 wlanmode sta
See madwifi-ng site documentation.
For mac80211 drivers, nothing has to be done, as airmon-ng keeps the managed interface alongside the monitor mode one (mac80211 uses interface types rather than modes of operation). If you no longer need the monitor interface and want to remove it, use the following:
airmon-ng stop monX
X is the monitor interface number — 0 unless you run multiple monitoring interfaces simultaneously.
Debugging issues
airmon-ng has two options to show more information, which can be useful when reporting or debugging issues.
—verbose flag
It gives information about the system as well as details about the wireless card.
root@kali:~# airmon-ng --verbose No LSB modules are available. Distributor ID: Kali Description: Kali GNU/Linux Rolling Release: 2019.1 Codename: n/a Linux kali 4.19.0-kali4-amd64 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) x86_64 GNU/Linux Detected VM using lspci This appears to be a VMware Virtual Machine If your system supports VT-d, it may be possible to use PCI devices If your system does not support VT-d, you can only use USB wifi cards K indicates driver is from 4.19.0-kali4-amd64 V indicates driver comes directly from the vendor, almost certainly a bad thing S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE ? indicates we do not know where the driver comes from... report this X[PHY]Interface Driver[Stack]-FirmwareRev Chipset Extended Info K[phy1]wlan0 ath9k_htc[mac80211]-1.4 Qualcomm Atheros Communications AR9271 802.11n mode managed
In this case, the following additional information can be seen:
-
Detailed information about the Linux distribution as well as kernel version
-
System is a virtual machine (and detailed information about supported features)
-
Detailed driver information (kernel, vendor driver, staging or unknown source), wireless stack, current operating mode and firmware version
—debug flag
It will give the same information as verbose and add more details:
root@kali:~# airmon-ng --debug /bin/sh -> /usr/bin/dash SHELL is GNU bash, version 5.0.3(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2019 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. No LSB modules are available. Distributor ID: Kali Description: Kali GNU/Linux Rolling Release: 2019.1 Codename: n/a Linux kali 4.19.0-kali4-amd64 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) x86_64 GNU/Linux Detected VM using lspci This appears to be a VMware Virtual Machine If your system supports VT-d, it may be possible to use PCI devices If your system does not support VT-d, you can only use USB wifi cards K indicates driver is from 4.19.0-kali4-amd64 V indicates driver comes directly from the vendor, almost certainly a bad thing S indicates driver comes from the staging tree, these drivers are meant for reference not actual use, BEWARE ? indicates we do not know where the driver comes from... report this X[PHY]Interface Driver[Stack]-FirmwareRev Chipset Extended Info getStack mac80211 getBus usb getdriver() ath9k_htc getchipset() Qualcomm Atheros Communications AR9271 802.11n BUS = usb BUSINFO = 0CF3:9271 DEVICEID = getFrom() K getFirmware 1.4 K[phy1]wlan0 ath9k_htc[mac80211]-1.4 Qualcomm Atheros Communications AR9271 802.11n mode managed
Additional information:
-
Shell name and version
-
Debug information regarding the wireless adapter and loaded driver
Usage Troubleshooting
Madwifi-ng
Quite often, the standard scripts on a linux distribution will setup ath0 and or additional athX interfaces. These must all be removed first per the instructions above. Another problem is that the script set fields such as essid, nickname and encryptions. Be sure these are all cleared.
Airmon-ng says the interface is not in monitor mode
~# airmon-ng stop wlan0mon PHY Interface Driver Chipset phy0 wlan0mon ath9k_htc Atheros Communications, Inc. AR9271 802.11n You are trying to stop a device that isn't in monitor mode. Doing so is a terrible idea, if you really want to do it then you need to type 'iw wlan2mon del' yourself since it is a terrible idea. Most likely you want to remove an interface called wlan[0-9]mon If you feel you have reached this warning in error, please report it.
It most likely mean the interface mode was changed from monitor to managed mode by a network manager. In this case, when stopping monitor mode, this is not a problem.
My interface was put in monitor mode but tools says it is not
It usually means the interface was put in monitor mode prior to killing network managers. And the network manager put the card back in managed mode.
Refer to the documentation above to kill network managers and put it back into monitor mode.
Interface athX number rising (ath0, ath1, ath2…. ath45..)
The original problem description and solution can be found in this forum thread.
Problem:
Every time the command “airmon-ng start wifi0 x” is run, a new interface is created as it should, but there where two problems. The first is that for each time airmon-ng is run on wifi0 the interface number on ath increases: the first time is ath1, the second ath2, the third ath3, and and so on. And this continues so in a short period of time it is up to ath56 and continuing to climb. Unloading the madwifi-ng driver, or rebooting the system has no effect, and the number of the interface created by airmon-ng continues to increase.
The second problem is that if you run airmon-ng on wifi0 the athXX created does not show as being shown as in Monitor mode, even though it is. This can be confirmed via iwconfig.
All these problem related to how udev assigns interface names. The answer is in this ticket: http://madwifi-project.org/ticket/972#comment:12 Thanks to lucida. The source of the problem comes from the udev persistent net rules generator.
Each distro is different… So here is a solution specifically for Gentoo. You should be able to adapt this solution to your particular distribution.
Gentoo 2.6.20-r4
Udev 104-r12
Madwifi 0.9.3-r2
Aircrack-ng 0.7-r2
Solution:
Change the file /etc/udev/rules.d/75-persistent-net-generator.rules
From: KERNEL==“eth*|ath*|wlan*|ra*|sta*……..
To: KERNEL==“eth*|Ath*|wlan*|ra*|sta*…….
In other words, you just capitalize the a. ath* becomes Ath*. Save the file.
Now delete the file /etc/udev/rules.d/70-persistent-net.rules.
Remove the driver and insert back.
Removing ath also works:
KERNEL==“eth*|wlan*|ra*|sta*….
This is also on Gentoo, both 2.6.19-gentoo-r5 and 2.6.20-gentoo-r6
For Ubuntu, see this Forum posting. The modified version of /etc/udev/rules.d/75-persistent-net-generator.rules is:
# these rules generate rules for persistent network device naming
ACTION=="add", SUBSYSTEM=="net", KERNEL=="eth*|Ath*|wlan*|ra*|sta*"
NAME!="?*", DRIVERS=="?*", GOTO="persistent_net_generator_do"
GOTO="persistent_net_generator_end"
LABEL="persistent_net_generator_do"
# build device description string to add a comment the generated rule
SUBSYSTEMS=="pci", ENV{COMMENT}="PCI device attr{vendor}:$attr{device}($attr{driver})"
SUBSYSTEMS=="usb", ENV{COMMENT}="USB device 0x$attr{idVendor}:0x$attr{idProduct}($attr{driver})"
SUBSYSTEMS=="ieee1394", ENV{COMMENT}="Firewire device $attr{host_id})"
SUBSYSTEMS=="xen", ENV{COMMENT}="Xen virtual device"
ENV{COMMENT}=="", ENV{COMMENT}="$env{SUBSYSTEM} device ($attr{driver})"
IMPORT{program}="write_net_rules $attr{address}"
ENV{INTERFACE_NEW}=="?*", NAME="$env{INTERFACE_NEW}"
LABEL="persistent_net_generator_end"
Interface ath1 created instead of ath0
This troubleshooting tip applies to madwifi-ng drivers. First try stopping each VAP interface that is running (“airmon-ng stop IFACE” where IFACE is the VAP name). You can obtain the list from iwconfig. Then do “airmon-ng start wifi0”.
If this does not resolve the problem then follow the advice in this thread.
Why do I get ioctl(SIOCGIFINDEX) failed?
If you get error messages similar to:
-
Error message: “SIOCSIFFLAGS : No such file or directory”
-
Error message: “ioctl(SIOCGIFINDEX) failed: No such device”
Then See this FAQ entry.
Error message: «wlanconfig: command not found»
If you receive “wlanconfig: command not found” or similar then the wlanconfig command is missing from your system or is not in the the path. Use locate or find to determine if it is on your system and which directory it is in.
If it is missing from your system then make sure you have done a “make install” after compiling the madwifi-ng drivers. On Ubuntu, do “apt-get install madwifi-tools”.
If it is not in a directory in your path then move it there or add the directory to your path.
airmon-ng shows RT2500 instead of RT73
Error «add_iface: Permission denied»
You receive an error similar to:
Interface Chipset Driver
wlan0 iwl4965 - [phy0]/usr/sbin/airmon-ng: line 338: /sys/class/ieee80211/phy0/add_iface: Permission denied
mon0: unknown interface: No matching device found
(monitor mode enabled on mon0)
or similar to this:
wlan0 iwlagn - [phy0]/usr/local/sbin/airmon-ng: 856: cannot create /sys/class/ieee80211/phy0/add_iface: Directory nonexistent Error for wireless request "Set Mode" (8B06) : SET failed on device mon0 ; No such device. mon0: ERROR while getting interface flags: No such device
This means you have an old version of airmon-ng installed. Upgrade to at least v1.0-rc1. Preferably you should upgrade to the current version. See the installation page for more details. Also, don’t forget you need to be root to use airmon-ng (or use sudo).
check kill fails
Distros from now on are going to adopt ‘upstart’ which is going to replace the /sbin/init daemon which manages services and tasks during boot.
Basically do:
service network-manager stop service avahi-daemon stop service upstart-udev-bridge stop
and then proceed with greping and killing the pids of dhclient and wpa_supplicant.
This is the only way to kill ALL of the potentially problematic pids for aireplay-ng permanently. The trick is the kill the daemons first and then terminate the ‘tasks’.
Source thread: http://forum.aircrack-ng.org/index.php?topic=6398.0 and http://forum.aircrack-ng.org/index.php?topic=8573
SIOCSIFFLAGS: Unknown error 132
If you have an output similar to:
# airmon-ng start wlan0 Interface Chipset Driver wlan0 Broadcom b43 - [phy0]SIOCSIFFLAGS: Unknown error 132 (monitor mode enabled on mon0)
It indicates that RF are blocked. It needs to be enabled by using the switch on your laptop and/or using the following command:
rfkill unblock all
See also http://ubuntuforums.org/showthread.php?t=1311886
ERROR adding monitor mode interface: command failed: Operation not supported (-95)
It is known to happen on the Raspberry Pi, when using airmon-ng. When that happens, the following can be seen in dmesg:
brcmfmac: brcmf_vif_add_validate: Attempt to add a MONITOR interface... brcmfmac: brcmf_vif_add_validate: ... there is already a monitor interface, returning EOPNOTSUPP brcmfmac: brcmf_cfg80211_add_iface: iface validation failed: err=-95
There may be instances of the following in dmesg as well prior to the above output:
brcmfmac: brcmf_vif_add_validate: Attempt to add a MONITOR interface... brcmfmac: brcmf_mon_add_vif: brcmf_mon_add_vif called brcmfmac: brcmf_mon_add_vif: Adding vif "wlan0mon" brcmfmac: brcmf_cfg80211_get_channel: chanspec failed (-52)
Even though dmesg says the interface is already in monitor mode and “iw dev wlan0 info” confirms it is, airodump-ng will fail and report the interface data linktype is Ethernet. This is a bug in the driver and/or firmware, and the workaround is to reboot the system or to reload the driver:
rmmod brcmfmac modprobe brcmfmac
@blmvxer
here :
[ 0.000000] Linux version 4.18.0-kali3-amd64 (devel@kali.org) (gcc version 7.3.0 (Debian 7.3.0-30)) #1 SMP Debian 4.18.20-2kali2 (2018-11-30) [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.18.0-kali3-amd64 root=UUID=6dd998d9-9743-48ab-9a30-6a2953e0d2fa ro initrd=/install/initrd.gz quiet [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format. [ 0.000000] BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000001ffeffff] usable [ 0.000000] BIOS-e820: [mem 0x000000001fff0000-0x000000001fffffff] ACPI data [ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] SMBIOS 2.5 present. [ 0.000000] DMI: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 0.000000] Hypervisor detected: KVM [ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved [ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable [ 0.000000] last_pfn = 0x1fff0 max_arch_pfn = 0x400000000 [ 0.000000] MTRR default type: uncachable [ 0.000000] MTRR variable ranges disabled: [ 0.000000] Disabled [ 0.000000] x86/PAT: MTRRs disabled, skipping PAT initialization too. [ 0.000000] CPU MTRRs all blank - virtualized system. [ 0.000000] x86/PAT: Configuration [0-7]: WB WT UC- UC WB WT UC- UC [ 0.000000] found SMP MP-table at [mem 0x0009fff0-0x0009ffff] mapped at [(____ptrval____)] [ 0.000000] Base memory trampoline at [(____ptrval____)] 99000 size 24576 [ 0.000000] BRK [0x16851000, 0x16851fff] PGTABLE [ 0.000000] BRK [0x16852000, 0x16852fff] PGTABLE [ 0.000000] BRK [0x16853000, 0x16853fff] PGTABLE [ 0.000000] BRK [0x16854000, 0x16854fff] PGTABLE [ 0.000000] BRK [0x16855000, 0x16855fff] PGTABLE [ 0.000000] RAMDISK: [mem 0x1d12a000-0x1f50afff] [ 0.000000] ACPI: Early table checksum verification disabled [ 0.000000] ACPI: RSDP 0x00000000000E0000 000024 (v02 VBOX ) [ 0.000000] ACPI: XSDT 0x000000001FFF0030 00003C (v01 VBOX VBOXXSDT 00000001 ASL 00000061) [ 0.000000] ACPI: FACP 0x000000001FFF00F0 0000F4 (v04 VBOX VBOXFACP 00000001 ASL 00000061) [ 0.000000] ACPI: DSDT 0x000000001FFF0470 0021FF (v02 VBOX VBOXBIOS 00000002 INTL 20100528) [ 0.000000] ACPI: FACS 0x000000001FFF0200 000040 [ 0.000000] ACPI: FACS 0x000000001FFF0200 000040 [ 0.000000] ACPI: APIC 0x000000001FFF0240 00005C (v02 VBOX VBOXAPIC 00000001 ASL 00000061) [ 0.000000] ACPI: SSDT 0x000000001FFF02A0 0001CC (v01 VBOX VBOXCPUT 00000002 INTL 20100528) [ 0.000000] ACPI: Local APIC address 0xfee00000 [ 0.000000] No NUMA configuration found [ 0.000000] Faking a node at [mem 0x0000000000000000-0x000000001ffeffff] [ 0.000000] NODE_DATA(0) allocated [mem 0x1ffeb000-0x1ffeffff] [ 0.000000] kvm-clock: cpu 0, msr 0:1ffe2001, primary cpu clock [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 [ 0.000000] kvm-clock: using sched offset of 16442296852 cycles [ 0.000000] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.000000] DMA32 [mem 0x0000000001000000-0x000000001ffeffff] [ 0.000000] Normal empty [ 0.000000] Device empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.000000] node 0: [mem 0x0000000000100000-0x000000001ffeffff] [ 0.000000] Reserved but unavailable: 114 pages [ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000001ffeffff] [ 0.000000] On node 0 totalpages: 130958 [ 0.000000] DMA zone: 64 pages used for memmap [ 0.000000] DMA zone: 21 pages reserved [ 0.000000] DMA zone: 3998 pages, LIFO batch:0 [ 0.000000] DMA32 zone: 1984 pages used for memmap [ 0.000000] DMA32 zone: 126960 pages, LIFO batch:31 [ 0.000000] ACPI: PM-Timer IO Port: 0x4008 [ 0.000000] ACPI: Local APIC address 0xfee00000 [ 0.000000] IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI 0-23 [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level) [ 0.000000] ACPI: IRQ0 used by override. [ 0.000000] ACPI: IRQ9 used by override. [ 0.000000] Using ACPI (MADT) for SMP configuration information [ 0.000000] smpboot: Allowing 2 CPUs, 0 hotplug CPUs [ 0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff] [ 0.000000] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff] [ 0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000effff] [ 0.000000] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff] [ 0.000000] [mem 0x20000000-0xfebfffff] available for PCI devices [ 0.000000] Booting paravirtualized kernel on KVM [ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns [ 0.000000] random: get_random_bytes called from start_kernel+0x94/0x52e with crng_init=0 [ 0.000000] setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:2 nr_node_ids:1 [ 0.000000] percpu: Embedded 44 pages/cpu @(____ptrval____) s142744 r8192 d29288 u1048576 [ 0.000000] pcpu-alloc: s142744 r8192 d29288 u1048576 alloc=1*2097152 [ 0.000000] pcpu-alloc: [0] 0 1 [ 0.000000] PV qspinlock hash table entries: 256 (order: 0, 4096 bytes) [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 128889 [ 0.000000] Policy zone: DMA32 [ 0.000000] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-4.18.0-kali3-amd64 root=UUID=6dd998d9-9743-48ab-9a30-6a2953e0d2fa ro initrd=/install/initrd.gz quiet [ 0.000000] Calgary: detecting Calgary via BIOS EBDA area [ 0.000000] Calgary: Unable to locate Rio Grande table in EBDA - bailing! [ 0.000000] Memory: 455436K/523832K available (10252K kernel code, 1227K rwdata, 3256K rodata, 1568K init, 656K bss, 68396K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] Kernel/User page tables isolation: enabled [ 0.000000] ftrace: allocating 31279 entries in 123 pages [ 0.004000] Hierarchical RCU implementation. [ 0.004000] RCU restricting CPUs from NR_CPUS=512 to nr_cpu_ids=2. [ 0.004000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2 [ 0.004000] NR_IRQS: 33024, nr_irqs: 440, preallocated irqs: 16 [ 0.004000] Console: colour VGA+ 80x25 [ 0.004000] console [tty0] enabled [ 0.004000] ACPI: Core revision 20180531 [ 0.004000] APIC: Switch to symmetric I/O mode setup [ 0.004000] x2apic enabled [ 0.004000] Switched APIC routing to physical x2apic. [ 0.007834] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 [ 0.008007] tsc: Detected 2591.596 MHz processor [ 0.008018] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x255b3928676, max_idle_ns: 440795202126 ns [ 0.008021] Calibrating delay loop (skipped) preset value.. 5183.19 BogoMIPS (lpj=10366384) [ 0.008026] pid_max: default: 32768 minimum: 301 [ 0.008094] Security Framework initialized [ 0.008096] Yama: disabled by default; enable with sysctl kernel.yama.* [ 0.008131] AppArmor: AppArmor initialized [ 0.008260] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes) [ 0.008318] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes) [ 0.008334] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes) [ 0.008338] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes) [ 0.012133] mce: CPU supports 0 MCE banks [ 0.012165] Last level iTLB entries: 4KB 512, 2MB 8, 4MB 8 [ 0.012167] Last level dTLB entries: 4KB 512, 2MB 32, 4MB 32, 1GB 0 [ 0.012171] Spectre V2 : Mitigation: Full generic retpoline [ 0.012172] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch [ 0.012174] Speculative Store Bypass: Vulnerable [ 0.012487] Freeing SMP alternatives memory: 24K [ 0.016000] smpboot: CPU0: Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz (family: 0x6, model: 0x3a, stepping: 0x9) [ 0.016000] Performance Events: unsupported p6 CPU model 58 no PMU driver, software events only. [ 0.016000] Hierarchical SRCU implementation. [ 0.016000] NMI watchdog: Perf event create on CPU 0 failed with -2 [ 0.016000] NMI watchdog: Perf NMI watchdog permanently disabled [ 0.016000] smp: Bringing up secondary CPUs ... [ 0.016000] x86: Booting SMP configuration: [ 0.016000] .... node #0, CPUs: #1 [ 0.004000] kvm-clock: cpu 1, msr 0:1ffe2041, secondary cpu clock [ 0.004000] mce: CPU supports 0 MCE banks [ 0.016053] smp: Brought up 1 node, 2 CPUs [ 0.016053] smpboot: Max logical packages: 1 [ 0.016053] smpboot: Total of 2 processors activated (10366.38 BogoMIPS) [ 0.016254] devtmpfs: initialized [ 0.016254] x86/mm: Memory block size: 128MB [ 0.016851] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 0.016851] futex hash table entries: 512 (order: 3, 32768 bytes) [ 0.016851] pinctrl core: initialized pinctrl subsystem [ 0.017491] NET: Registered protocol family 16 [ 0.020037] audit: initializing netlink subsys (disabled) [ 0.020090] audit: type=2000 audit(1544181824.882:1): state=initialized audit_enabled=0 res=1 [ 0.020288] cpuidle: using governor ladder [ 0.020288] cpuidle: using governor menu [ 0.020288] ACPI: bus type PCI registered [ 0.020288] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5 [ 0.020427] PCI: Using configuration type 1 for base access [ 0.024223] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages [ 0.024223] ACPI: Added _OSI(Module Device) [ 0.024223] ACPI: Added _OSI(Processor Device) [ 0.024223] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.024223] ACPI: Added _OSI(Processor Aggregator Device) [ 0.024223] ACPI: Added _OSI(Linux-Dell-Video) [ 0.031337] ACPI: 2 ACPI AML tables successfully acquired and loaded [ 0.035717] ACPI: Interpreter enabled [ 0.035750] ACPI: (supports S0 S5) [ 0.035752] ACPI: Using IOAPIC for interrupt routing [ 0.036451] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug [ 0.036833] ACPI: Enabled 2 GPEs in block 00 to 07 [ 0.052132] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) [ 0.052142] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI] [ 0.052188] acpi PNP0A03:00: _OSC: not requesting OS control; OS requires [ExtendedConfig ASPM ClockPM MSI] [ 0.052208] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge. [ 0.053014] PCI host bridge to bus 0000:00 [ 0.053020] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] [ 0.053025] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] [ 0.053030] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] [ 0.053035] pci_bus 0000:00: root bus resource [mem 0x20000000-0xfdffffff window] [ 0.053040] pci_bus 0000:00: root bus resource [bus 00-ff] [ 0.053138] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 0.054533] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100 [ 0.056476] pci 0000:00:01.1: [8086:7111] type 00 class 0x01018a [ 0.057504] pci 0000:00:01.1: reg 0x20: [io 0xd000-0xd00f] [ 0.057908] pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io 0x01f0-0x01f7] [ 0.057912] pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io 0x03f6] [ 0.057916] pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io 0x0170-0x0177] [ 0.057920] pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io 0x0376] [ 0.058544] pci 0000:00:02.0: [80ee:beef] type 00 class 0x030000 [ 0.063669] pci 0000:00:02.0: reg 0x10: [mem 0xe0000000-0xe7ffffff pref] [ 0.093069] pci 0000:00:03.0: [8086:100e] type 00 class 0x020000 [ 0.094197] pci 0000:00:03.0: reg 0x10: [mem 0xf0000000-0xf001ffff] [ 0.096333] pci 0000:00:03.0: reg 0x18: [io 0xd010-0xd017] [ 0.101819] pci 0000:00:04.0: [80ee:cafe] type 00 class 0x088000 [ 0.103172] pci 0000:00:04.0: reg 0x10: [io 0xd020-0xd03f] [ 0.104426] pci 0000:00:04.0: reg 0x14: [mem 0xf0400000-0xf07fffff] [ 0.105341] pci 0000:00:04.0: reg 0x18: [mem 0xf0800000-0xf0803fff pref] [ 0.109959] pci 0000:00:05.0: [8086:2415] type 00 class 0x040100 [ 0.110317] pci 0000:00:05.0: reg 0x10: [io 0xd100-0xd1ff] [ 0.110507] pci 0000:00:05.0: reg 0x14: [io 0xd200-0xd23f] [ 0.112516] pci 0000:00:06.0: [106b:003f] type 00 class 0x0c0310 [ 0.113529] pci 0000:00:06.0: reg 0x10: [mem 0xf0804000-0xf0804fff] [ 0.121373] pci 0000:00:07.0: [8086:7113] type 00 class 0x068000 [ 0.122628] pci 0000:00:07.0: quirk: [io 0x4000-0x403f] claimed by PIIX4 ACPI [ 0.122655] pci 0000:00:07.0: quirk: [io 0x4100-0x410f] claimed by PIIX4 SMB [ 0.124122] pci 0000:00:0d.0: [8086:2829] type 00 class 0x010601 [ 0.125714] pci 0000:00:0d.0: reg 0x10: [io 0xd240-0xd247] [ 0.126692] pci 0000:00:0d.0: reg 0x14: [io 0xd248-0xd24b] [ 0.127745] pci 0000:00:0d.0: reg 0x18: [io 0xd250-0xd257] [ 0.128315] pci 0000:00:0d.0: reg 0x1c: [io 0xd258-0xd25b] [ 0.129612] pci 0000:00:0d.0: reg 0x20: [io 0xd260-0xd26f] [ 0.130721] pci 0000:00:0d.0: reg 0x24: [mem 0xf0806000-0xf0807fff] [ 0.137361] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 9 10 *11) [ 0.138124] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 9 *10 11) [ 0.138378] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 *9 10 11) [ 0.138625] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 9 10 *11) [ 0.139208] pci 0000:00:02.0: vgaarb: setting as boot VGA device [ 0.139208] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 0.140013] pci 0000:00:02.0: vgaarb: bridge control possible [ 0.140015] vgaarb: loaded [ 0.140178] pps_core: LinuxPPS API ver. 1 registered [ 0.140180] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> [ 0.140187] PTP clock support registered [ 0.140214] EDAC MC: Ver: 3.0.0 [ 0.141149] PCI: Using ACPI for IRQ routing [ 0.141149] PCI: pci_cache_line_size set to 64 bytes [ 0.141149] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff] [ 0.141149] e820: reserve RAM buffer [mem 0x1fff0000-0x1fffffff] [ 0.144871] clocksource: Switched to clocksource kvm-clock [ 0.182800] VFS: Disk quotas dquot_6.6.0 [ 0.182834] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 0.183108] AppArmor: AppArmor Filesystem Enabled [ 0.183152] pnp: PnP ACPI init [ 0.183294] pnp 00:00: Plug and Play ACPI device, IDs PNP0303 (active) [ 0.183519] pnp 00:01: Plug and Play ACPI device, IDs PNP0f03 (active) [ 0.185353] pnp: PnP ACPI: found 2 devices [ 0.200748] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 0.200766] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] [ 0.200769] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] [ 0.200773] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] [ 0.200776] pci_bus 0000:00: resource 7 [mem 0x20000000-0xfdffffff window] [ 0.200889] NET: Registered protocol family 2 [ 0.201280] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes) [ 0.201300] TCP established hash table entries: 4096 (order: 3, 32768 bytes) [ 0.201326] TCP bind hash table entries: 4096 (order: 4, 65536 bytes) [ 0.201353] TCP: Hash tables configured (established 4096 bind 4096) [ 0.201390] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.201397] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.201448] NET: Registered protocol family 1 [ 0.201464] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 0.201518] pci 0000:00:01.0: Activating ISA DMA hang workarounds [ 0.201638] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 0.204300] PCI: CLS 0 bytes, default 64 [ 0.204382] Unpacking initramfs... [ 1.530367] Freeing initrd memory: 36740K [ 1.530486] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x255b3928676, max_idle_ns: 440795202126 ns [ 1.530540] platform rtc_cmos: registered platform RTC device (no PNP device found) [ 1.531580] Initialise system trusted keyrings [ 1.531788] workingset: timestamp_bits=40 max_order=17 bucket_order=0 [ 1.536776] zbud: loaded [ 1.537479] pstore: using deflate compression [ 1.970634] Key type asymmetric registered [ 1.970637] Asymmetric key parser 'x509' registered [ 1.970716] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248) [ 1.970841] io scheduler noop registered [ 1.970843] io scheduler deadline registered [ 1.970897] io scheduler cfq registered (default) [ 1.970900] io scheduler mq-deadline registered [ 1.971206] shpchp: Standard Hot Plug PCI Controller Driver version: 0.4 [ 1.971228] intel_idle: Please enable MWAIT in BIOS SETUP [ 1.971606] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 1.972945] Linux agpgart interface v0.103 [ 1.973151] AMD IOMMUv2 driver by Joerg Roedel <jroedel@suse.de> [ 1.973152] AMD IOMMUv2 functionality not available on this system [ 1.973594] i8042: PNP: PS/2 Controller [PNP0303:PS2K,PNP0f03:PS2M] at 0x60,0x64 irq 1,12 [ 1.974367] serio: i8042 KBD port at 0x60,0x64 irq 1 [ 1.974374] serio: i8042 AUX port at 0x60,0x64 irq 12 [ 1.974725] mousedev: PS/2 mouse device common for all mice [ 1.975749] rtc_cmos rtc_cmos: registered as rtc0 [ 1.975864] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input0 [ 1.976192] rtc_cmos rtc_cmos: alarms up to one day, 114 bytes nvram [ 1.976312] ledtrig-cpu: registered to indicate activity on CPUs [ 1.976882] NET: Registered protocol family 10 [ 1.984874] Segment Routing with IPv6 [ 1.984923] mip6: Mobile IPv6 [ 1.984926] NET: Registered protocol family 17 [ 1.984932] mpls_gso: MPLS GSO support [ 1.985365] sched_clock: Marking stable (1985165894, 0)->(2799325902, -814160008) [ 1.986463] registered taskstats version 1 [ 1.986465] Loading compiled-in X.509 certificates [ 2.047504] Loaded X.509 cert 'secure-boot-test-key-lfaraone: 97c1b25cddf9873ca78a58f3d73bf727d2cf78ff' [ 2.047539] zswap: loaded using pool lzo/zbud [ 2.048048] AppArmor: AppArmor sha1 policy hashing enabled [ 2.048698] rtc_cmos rtc_cmos: setting system clock to 2018-12-07 11:23:28 UTC (1544181808) [ 2.056767] Freeing unused kernel image memory: 1568K [ 2.072676] Write protecting the kernel read-only data: 16384k [ 2.074131] Freeing unused kernel image memory: 2028K [ 2.074631] Freeing unused kernel image memory: 840K [ 2.106754] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 2.106756] x86/mm: Checking user space page tables [ 2.136367] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 2.489712] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI [ 2.489714] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 2.499223] SCSI subsystem initialized [ 2.511261] piix4_smbus 0000:00:07.0: SMBus Host Controller at 0x4100, revision 0 [ 2.515848] ACPI: bus type USB registered [ 2.515895] usbcore: registered new interface driver usbfs [ 2.515916] usbcore: registered new interface driver hub [ 2.515968] usbcore: registered new device driver usb [ 2.524106] libata version 3.00 loaded. [ 2.526871] ata_piix 0000:00:01.1: version 2.13 [ 2.549579] ahci 0000:00:0d.0: version 3.0 [ 2.549592] cryptd: max_cpu_qlen set to 1000 [ 2.551606] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 2.552264] ahci 0000:00:0d.0: SSS flag set, parallel bus scan disabled [ 2.552568] ahci 0000:00:0d.0: AHCI 0001.0100 32 slots 1 ports 3 Gbps 0x1 impl SATA mode [ 2.552574] ahci 0000:00:0d.0: flags: 64bit ncq stag only ccc [ 2.553238] scsi host1: ahci [ 2.553660] ata3: SATA max UDMA/133 abar m8192@0xf0806000 port 0xf0806100 irq 21 [ 2.553680] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 2.554860] ehci-pci: EHCI PCI platform driver [ 2.555711] ohci-pci: OHCI PCI platform driver [ 2.557160] ohci-pci 0000:00:06.0: OHCI PCI host controller [ 2.557171] ohci-pci 0000:00:06.0: new USB bus registered, assigned bus number 1 [ 2.557314] ohci-pci 0000:00:06.0: irq 22, io mem 0xf0804000 [ 2.561638] scsi host0: ata_piix [ 2.567955] AVX version of gcm_enc/dec engaged. [ 2.567956] AES CTR mode by8 optimization enabled [ 2.574314] scsi host2: ata_piix [ 2.574455] ata1: PATA max UDMA/33 cmd 0x1f0 ctl 0x3f6 bmdma 0xd000 irq 14 [ 2.574458] ata2: PATA max UDMA/33 cmd 0x170 ctl 0x376 bmdma 0xd008 irq 15 [ 2.617098] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 4.18 [ 2.617103] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 2.617107] usb usb1: Product: OHCI PCI host controller [ 2.617111] usb usb1: Manufacturer: Linux 4.18.0-kali3-amd64 ohci_hcd [ 2.617114] usb usb1: SerialNumber: 0000:00:06.0 [ 2.617584] hub 1-0:1.0: USB hub found [ 2.617746] hub 1-0:1.0: 12 ports detected [ 2.631310] alg: No test for pcbc(aes) (pcbc-aes-aesni) [ 2.747427] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input2 [ 2.749010] ata2.00: ATAPI: VBOX CD-ROM, 1.0, max UDMA/133 [ 2.880761] ata3: SATA link up 3.0 Gbps (SStatus 123 SControl 300) [ 2.880957] ata3.00: ATA-6: VBOX HARDDISK, 1.0, max UDMA/133 [ 2.880960] ata3.00: 167772160 sectors, multi 128: LBA48 NCQ (depth 32) [ 2.881214] ata3.00: configured for UDMA/133 [ 2.884260] scsi 1:0:0:0: Direct-Access ATA VBOX HARDDISK 1.0 PQ: 0 ANSI: 5 [ 2.885206] scsi 2:0:0:0: CD-ROM VBOX CD-ROM 1.0 PQ: 0 ANSI: 5 [ 2.900263] sd 1:0:0:0: [sda] 167772160 512-byte logical blocks: (85.9 GB/80.0 GiB) [ 2.900274] sd 1:0:0:0: [sda] Write Protect is off [ 2.900278] sd 1:0:0:0: [sda] Mode Sense: 00 3a 00 00 [ 2.900293] sd 1:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 2.928605] sda: sda1 sda2 < sda5 > [ 2.929120] sd 1:0:0:0: [sda] Attached SCSI disk [ 2.981358] sr 2:0:0:0: [sr0] scsi3-mmc drive: 32x/32x xa/form2 tray [ 2.981361] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 2.981684] sr 2:0:0:0: Attached scsi CD-ROM sr0 [ 3.016316] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 08:00:27:95:8c:5e [ 3.016325] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection [ 3.034800] random: fast init done [ 3.084388] usb 1-1: new full-speed USB device number 2 using ohci-pci [ 3.352772] PM: Image not found (code -22) [ 3.411764] usb 1-1: New USB device found, idVendor=80ee, idProduct=0021, bcdDevice= 1.00 [ 3.411769] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 3.411773] usb 1-1: Product: USB Tablet [ 3.411776] usb 1-1: Manufacturer: VirtualBox [ 3.437270] hidraw: raw HID events driver (C) Jiri Kosina [ 3.453002] usbcore: registered new interface driver usbhid [ 3.453003] usbhid: USB HID core driver [ 3.457074] input: VirtualBox USB Tablet as /devices/pci0000:00/0000:00:06.0/usb1/1-1/1-1:1.0/0003:80EE:0021.0001/input/input3 [ 3.457847] hid-generic 0003:80EE:0021.0001: input,hidraw0: USB HID v1.10 Mouse [VirtualBox USB Tablet] on usb-0000:00:06.0-1/input0 [ 4.214673] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null) [ 7.825333] systemd[1]: systemd 239 running in system mode. (+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid) [ 7.825387] systemd[1]: Detected virtualization oracle. [ 7.825399] systemd[1]: Detected architecture x86-64. [ 7.838611] systemd[1]: Set hostname to <kali>. [ 9.699372] random: systemd: uninitialized urandom read (16 bytes read) [ 9.699548] systemd[1]: Started Dispatch Password Requests to Console Directory Watch. [ 9.699610] random: systemd: uninitialized urandom read (16 bytes read) [ 9.699783] systemd[1]: Listening on udev Control Socket. [ 9.699806] random: systemd: uninitialized urandom read (16 bytes read) [ 9.699956] systemd[1]: Listening on Journal Socket. [ 9.704670] systemd[1]: Mounting POSIX Message Queue File System... [ 9.706497] systemd[1]: Starting Create list of required static device nodes for the current kernel... [ 9.706860] systemd[1]: Set up automount Arbitrary Executable File Formats File System Automount Point. [ 10.852948] EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro [ 11.059093] systemd-journald[279]: Received request to flush runtime journal from PID 1 [ 13.176992] random: crng init done [ 13.176994] random: 7 urandom warning(s) missed due to ratelimiting [ 13.794049] ACPI: AC Adapter [AC] (on-line) [ 13.806683] ACPI: Video Device [GFX0] (multi-head: yes rom: no post: no) [ 13.806837] input: Video Bus as /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/LNXVIDEO:00/input/input4 [ 13.925360] ACPI: Battery Slot [BAT0] (battery present) [ 13.940759] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input5 [ 13.940795] ACPI: Power Button [PWRF] [ 13.940983] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input6 [ 13.941005] ACPI: Sleep Button [SLPF] [ 14.107330] vboxguest: loading out-of-tree module taints kernel. [ 14.140823] vgdrvHeartbeatInit: Setting up heartbeat to trigger every 2000 milliseconds [ 14.140986] input: Unspecified device as /devices/pci0000:00/0000:00:04.0/input/input7 [ 14.141132] vboxguest: misc device minor 58, IRQ 20, I/O port d020, MMIO at 00000000f0400000 (size 0x400000) [ 14.141134] vboxguest: Successfully loaded version 5.2.22_Debian (interface 0x00010004) [ 14.142299] input: PC Speaker as /devices/platform/pcspkr/input/input8 [ 14.252463] sd 1:0:0:0: Attached scsi generic sg0 type 0 [ 14.252610] sr 2:0:0:0: Attached scsi generic sg1 type 5 [ 14.315188] [drm] VRAM 08000000 [ 14.315431] [TTM] Zone kernel: Available graphics memory: 248318 kiB [ 14.315432] [TTM] Initializing pool allocator [ 14.315440] [TTM] Initializing DMA pool allocator [ 14.320618] fbcon: vboxdrmfb (fb0) is primary device [ 14.332343] Console: switching to colour frame buffer device 100x37 [ 14.357564] vboxvideo 0000:00:02.0: fb0: vboxdrmfb frame buffer device [ 14.381985] [drm] Initialized vboxvideo 1.0.0 20130823 for 0000:00:02.0 on minor 0 [ 14.428308] RAPL PMU: API unit is 2^-32 Joules, 3 fixed counters, 10737418240 ms ovfl timer [ 14.428310] RAPL PMU: hw unit of domain pp0-core 2^-0 Joules [ 14.428312] RAPL PMU: hw unit of domain package 2^-0 Joules [ 14.428314] RAPL PMU: hw unit of domain pp1-gpu 2^-0 Joules [ 15.677210] snd_intel8x0 0000:00:05.0: white list rate for 1028:0177 is 48000 [ 15.857391] Adding 2095100k swap on /dev/sda5. Priority:-2 extents:1 across:2095100k FS [ 22.192293] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 22.197406] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 22.200169] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 22.201032] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Asked
6 years, 10 months ago
Viewed
9k times
I have installed Kali Linux on my Raspberry PI2 Model B. I have also bought Raspberry PI USB Wi-Fi Dongle. When I try to put the adaptor into «monitor mode» using airmon-ng start wlan0 I get an error (ERROR adding monitor mode interface: command failed: Operation not supported (-95)). What can I do to fix it (buy a different one or something else) ?
NULL
2,2108 gold badges24 silver badges49 bronze badges
asked Apr 5, 2016 at 12:46
1
The Raspberry-Pi Wi-Fi adapter is based on the BCM43143 (official product description) chipset which does not support monitor mode with current drivers. (as written here).
answered Apr 5, 2016 at 13:22
MononessMononess
2011 silver badge3 bronze badges
0
You should try a USB WiFi Dongle that has the supporting chip-set.
Then install required drivers , then use airmon-ng. This should work.
answered Jul 4, 2020 at 3:28
Sohan ArafatSohan Arafat
1,7901 gold badge9 silver badges39 bronze badges
I’ve been searching for the answer to this for hours and nothing has helped.
I’m trying to enter monitor (promisc) mode in kali and it keeps coming up with errors. I’ve updated kernels, drivers, etc. and no luck. I think I may have to buy an external wireless device, but want to try here in case a genius can solve my problem before I spend the money. Below is a print out of all the relevant info that should assist (I hope). I’m on a Macbook Pro late 2015.
I have Kali installed as a partition, but I also have the same problem when booting it live from a USB.
root@kali:~# uname -r
4.12.0-kali1-amd64
root@kali:~# lspci -nn -d 14e4:
04:00.0 Network controller [0280]: Broadcom Limited BCM43602 802.11ac Wireless LAN SoC [14e4:43ba] (rev 01)
05:00.0 Multimedia controller [0480]: Broadcom Limited 720p FaceTime HD Camera [14e4:1570]
root@kali:~# iwconfig
lo no wireless extensions.
wlan0 IEEE 802.11 ESSID:"******"
Mode:Managed Frequency:2.412 GHz Access Point: ******
Bit Rate=24 Mb/s Tx-Power=31 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
Link Quality=70/70 Signal level=-37 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:1 Invalid misc:0 Missed beacon:0
root@kali:~# ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 288 bytes 22776 (22.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 288 bytes 22776 (22.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.6 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 ***************** prefixlen 64 scopeid 0x20<link>
ether ************* txqueuelen 1000 (Ethernet)
RX packets 21851 bytes 23490115 (22.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 15106 bytes 1764309 (1.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
root@kali:~# ifconfig wlan0 down
root@kali:~# ifconfig wlan0 -promisc
root@kali:~# ifconfig wlan0 up
root@kali:~# iwconfig
lo no wireless extensions.
wlan0 IEEE 802.11 ESSID:off/any
**Mode:Managed** Access Point: Not-Associated Tx-Power=31 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
root@kali:~# ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 816 bytes 61704 (60.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 816 bytes 61704 (60.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether ************** txqueuelen 1000 (Ethernet)
RX packets 21954 bytes 23496840 (22.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 15113 bytes 1765136 (1.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
root@kali:~# airmon-ng start wlan0
PHY Interface Driver Chipset
phy0 wlan0 brcmfmac Broadcom Limited BCM43602 802.11ac Wireless LAN SoC (rev 01)
**ERROR adding monitor mode interface: command failed: Operation not supported (-95)**
root@kali:~# ifconfig wlan0 down
root@kali:~# iwconfig wlan0 mode Monitor
**Error for wireless request "Set Mode" (8B06) :
SET failed on device wlan0 ; Operation not supported.**
(Why??)
Im trying to create a evil twin on my own network. I followed some tutorials how to create one. My raspberrypi is controlled by SSH via lan but i found a Wlan usb stick that is now plugged in but doesnt work. I googled why and on certain platforms they said I needed a driver.
Im using airmon-ng
Procedure:
hops@networker:~ $ sudo ifconfig wlan0 down
hops@networker:~ $ sudo airmon-ng check kill
Killing these processes:
PID Name
407 wpa_supplicant
511 wpa_supplicant
597 dhcpcd
hops@networker:~ $ sudo airmon-ng start wlan0
Found 2 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
857 wpa_supplicant
880 dhcpcd
PHY Interface Driver Chipset
phy0 wlan0 brcmfmac Broadcom 43430
ERROR adding monitor mode interface: command failed: Operation not supported (-95)
- I don’t know what exactly I’m doing wrong why this happens.
- Why I can’t kill the other processes that are still running
My Wlan-usb: TP-Link Archer T3U
OS: Rasbian Os 64-Bit lite
Thanks for your answer 
-
#2
Не самый лучший вариант выбора адаптера (ALFA AWUS 1900 ).
С ним всегда проблемы ,даже мнение бытовало ,что с Airmon-ng дела плохи.
Можно рискнуть поправить положение.
Удаляем нерабочую версию драйвера:
Код:
# rmmod имя_модуля
# modprobe -r имя_модуляКачаем то,что должно работать:
Код:
apt install realtek-rtl88xxau-dkmsЛибо берём отсюда
Ставим:
Код:
# cd rtl8814au
# make
# make install
# modprobe 8814auИ пробуем перевести в режим монитора:
Код:
# ip link set wlan0 down
# iwconfig wlan0 mode monitor
# ip link set wlan0 upНа всякий случай если потребуется информация о том,какие драйвера пригодны для Linux для режима монитора и т.д.
Смотрим
Ссылка скрыта от гостей
Последнее редактирование: 13.12.2018
Достоевский Ф.М.
-
#3
Спасибо за ответ ))
Vertigo, всё получилось ))
Но адаптер переводится в режим «AUTO» ))
Ну, это почти «монитор» ))
-
#4
Ну, это почти «монитор» ))
Риск как никак.)
Это не моя какая-то намеренная диверсия.
Прошу прощения.
В Kali Linux ,к примеру, решили этот вопрос именно
Ссылка скрыта от гостей
Так,а если так попробовать ( успех проверяется командой # iw dev):
Код:
# ip link set wlan0 down
# iw wlan0 set monitor control
# ip link set wlan0 upЛибо пробуем создать виртуальный интерфейс (удаляется он командой # iw dev mon0 del):
Код:
# iw phy phy0 interface add mon0 type monitor
# ip link set mon0 down
# iw mon0 set monitor control
# ip link set mon0 upЕсли вирт.интерфейс не переведётся в режим монитора,то можно докачать wicd вместо NetworkManager.
Последний не удалять,а отключить:
Код:
# apt-get install wicd
# systemctl stop NetworkManager
# airmon-ng check kill
# wicd и подключаемся к инету и пробуем создать вирт.интерфейс
-
#5
Так,а если так попробовать ( успех проверяется командой # iw dev):
Код:
# ip link set wlan0 down
# iw wlan0 set monitor control
# ip link set wlan0 upOperation not supported
Код:
nechta@nechta-desktop:~$ iw dev
phy#0
Interface wlx00c0caa50dac
ifindex 3
wdev 0x1
addr ce:c0:01:35:3e:8a
type managed
txpower 12.00 dBm
nechta@nechta-desktop:~$ sudo ip link set wlx00c0caa50dac down
[sudo] пароль для nechta:
nechta@nechta-desktop:~$ sudo iw wlx00c0caa50dac set monitor control
command failed: Operation not supported (-95)
nechta@nechta-desktop:~$Попытка перевести в режим монитора командой airmon-ng приводят к тому же результату ))
Код:
nechta@nechta-desktop:~$ sudo airmon-ng start wlx00c0caa50dac
Found 5 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'
PID Name
712 avahi-daemon
728 wpa_supplicant
767 avahi-daemon
793 NetworkManager
947 dhclient
PHY Interface Driver Chipset
phy0 wlx00c0caa50dac rtl8814au Realtek Semiconductor Corp.
Interface 15mon is too long for linux so it will be renamed to the old style (wlan#) name.
ERROR adding monitor mode interface: command failed: Operation not supported (-95)
(mac80211 station mode vif disabled for [phy0]wlx00c0caa50dac)Последнее редактирование: 15.12.2018
-
#6
Имеется ALFA AWUS 1900.
ОС — Ubuntu .
Я установил в систему драйвер вышеназванного девайса, но с этим драйвером невозможно перевести устройство в режим монитора.
Хочу переустановить, заменить драйвер.
Но не знаю, как произвести переустановку драйвера ))
Как удалить драйвер в Linux ?
Ответ здесь.
Режим монитора Alfa AWUS 1900 в UBUNTU.
Hello ,
I have a small project I want to run in my house using PI-zero
I have found this code online
«Scapy: Finding All Wi-Fi Devices»
which scan to see which wifi is on around me
but when I run the code I get no resualt (no erroes ) , just empty
what did I miss?
Code: Select all
#!/usr/bin/python
import sys
from scapy.all import *
devices = set()
def PackerHandler(pkt):
if pkt.haslayer(Dot11):
dot11_layer = pkt.getlayer(Dot11)
if dot11_layer.addr2:
devices.add(dot11_layer.addr2)
print len(devices),dot11_layer.addr2,dot11_layer.payload.name
sniff (iface = sys.argv[1] , count = int(sys.argv[2]) , prn = PackerHandler)
what did I miss?
it should be a very simple code to run
I have try with Wlan0 disableenables — same resualt on both cases
*****
I have also found this post
https://www.thepythoncode.com/article/b … thon-scapy
when it say to download
aircrack-ng.org
but when I try to run it I get this error:
Code: Select all
sudo airmon-ng start wlan0
Found 5 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
PID Name
331 wpa_supplicant
336 avahi-daemon
380 avahi-daemon
418 wpa_supplicant
491 dhcpcd
PHY Interface Driver Chipset
phy0 wlan0 brcmfmac Broadcom 43430
ERROR adding monitor mode interface: command failed: Operation not supported (-95)
what is wrong missing?
https://medium.com/swlh/scanning-for-mo … 99be08cc1e
Thanks ,