After I stop NetworkManager and restart it, I still don't connect to wi-fi?

I’m using Ubuntu 22.04.2 LTS

For context I’m trying to get Wireshark to monitor my wifi interface and having trouble.

These are the commands I am using:

1.sudo service NetworkManager stop

2.sudo ip link set <interface> down

3.sudo iw <interface> set monitor none

  1. sudo ip link set <interface> up

  2. sudo service NetworkManager restart

I expect my wifi to reconnect here but nothing happens. I checked sudo systemctl status NetworkManager and it says that Network Manager is active.

I’ve tried nmcli networking on with no luck. Also sudo ifconfig <interface> down and ifconfig <interface> up. Doesn’t work. If I take out all the NetworkManager commands I get off of wifi and get onto wifi with no problems, but can’t seem to maintain monitor mode once I get on Wireshark. And one of the suggestions on a Wireshark forum was to turn off and on Network Manager so here I am trying to make this work.

How do I get back on wifi from here without having to restart my computer?

Asked By: filifunk


If you just want to monitor traffic from your connection while you are connected to wifi, you don’t need to use monitor mode.

Also, NetworkManager won’t connect to your wifi AP if the device is in monitor mode, it has to be in managed mode to be managed by NetworkManager.

First, run the following command to get back into managed mode:

sudo iwconfig <device> mode managed 

and then restart NetworkManager:

sudo systemctl restart NetworkManager

This should connect you back to your wifi network access point or at least you should be able to select your access point from the list of available networks to connect if it doesn’t connect automatically.

So if you just want to monitor traffic to and from your device, you can simply run wireshark:

sudo -i wireshark

and then select your interface from the list of devices. Example: wlp1s0

It should start capturing traffic.

Now if you really want to use monitor mode, you can create a separate virtual interface in monitor mode.

Use the following to list your devices:

iw dev

This should show something like phy#0.

Using phy#0 as an example, we would use phy0 in the following command to add a monitor device named mon0:

sudo iw phy phy0 interface add mon0 type monitor

Now, bring the device up:

sudo ifconfig mon0 up

At this point, you can stop NetworkManager and run Wireshark in wireless monitor mode:

sudo systemctl stop NetworkManager
sudo -i wireshark

and select mon0 from your list of interfaces.

You will not be able to use the internet from your device without NetworkManager but you will be sniffing all kinds of traffic monitored from other devices broadcasting within range.

It is possible to monitor using mon0 while using NetworkManager to connect to the internet through wlp1s0 or whatever your regular wireless device is. But I don’t think that is ideal and when I’ve done this, it doesn’t seem to sniff all the other devices broadcasting within range.

Also, when you’re done using Wireshark, you can delete your monitor device:

sudo iw dev mon0 del
Answered By: mchid