iw list and ensure you are running commands with elevated privileges, as detailed in our guide on Run Programs with Elevated Privileges: A Comprehensive Guide.
Understanding Error -95
The error code -95, often associated with the message "operation not supported," is a standard Linux kernel return value indicating that the requested operation is invalid for the current state or hardware configuration. In the context of wireless networking, specifically when attempting to set monitor mode via iw dev wlan0 type monitor, this error almost always points to a limitation in the driver or the hardware itself.
Monitor mode allows a network interface card (NIC) to capture all packets it sees on the air, rather than just those addressed to its MAC address. While useful for network analysis, security auditing, and penetration testing, not all wireless adapters support this functionality. ARM-based devices, such as Raspberry Pi boards or embedded IoT modules, frequently use compact Wi-Fi chips that may lack the firmware or hardware registers necessary to toggle into promiscuous monitoring states.
Verifying Driver and Hardware Support
Before attempting complex workarounds, you must confirm whether your specific wireless adapter can enter monitor mode. The primary tool for this verification is the iw utility, which queries the driver for its capabilities.
- Identify your interface: Use
ip link showoriwconfigto find the name of your wireless interface. It is typically namedwlan0, but could bewlan1or similar depending on your system configuration. - Query capabilities: Run the command
iw list | grep -A 15 "Supported interface modes". This section lists all modes the driver claims to support. - Check for Monitor mode: Look for the line
* monitorwithin the output. Ifmonitoris absent, your driver explicitly does not support monitor mode. If it is present, the issue may lie elsewhere, such as the interface being locked by another process.
If the monitor keyword is missing, no software trick will enable it. You would need to replace the hardware with an adapter known for monitor mode support, such as those using the Atheros AR9271 chipset or newer Realtek chips with patched drivers.
Checking Interface State and Conflicts
Even if the driver supports monitor mode, the interface might be busy or in a state that prevents switching. Network managers like NetworkManager or wpa_supplicant often lock interfaces to prevent conflicts.
- Stop network services: Ensure that
NetworkManageris not managing the interface. You can disable it temporarily withsudo systemctl stop NetworkManageror set the interface to unmanaged in its configuration file. - Kill wpa_supplicant: If
wpa_supplicantis running, it may hold the interface open. Stop it usingsudo pkill wpa_supplicant. - Bring the interface down: Before changing the type, bring the interface down using
sudo ip link set wlan0 down. Some drivers require the interface to be inactive before allowing mode changes.
After ensuring the interface is down and no other processes are holding it, attempt the command again: sudo iw dev wlan0 type monitor change. Note that some older versions of iw used set instead of change, though change is generally safer as it only modifies the mode without resetting the interface.
Driver-Specific Workarounds
Certain drivers have unique quirks or require additional steps to enable monitor mode. For example, some Realtek drivers may require loading specific kernel modules with flags enabled. Others might need you to use airmon-ng from the Aircrack-ng suite, which handles the complex sequence of stopping services and putting the interface into monitor mode automatically.
If you are using airmon-ng, run sudo airmon-ng start wlan0. This script checks for conflicting processes, kills them, and attempts to set the monitor mode. If airmon-ng fails with the same error, it confirms that the hardware/driver combination simply does not support the feature on your current kernel version.
In rare cases, updating the firmware or the driver itself might resolve the issue. Check if there are newer versions of the firmware available for your specific chip. On ARM-based systems, firmware updates are often handled through package managers like apt or dnf, or via vendor-specific update utilities.
Alternative Approaches
If your hardware definitively does not support monitor mode, consider alternative methods for network analysis. You can use port mirroring (SPAN) on managed switches to copy traffic to a different port connected to a capable device. Alternatively, USB Wi-Fi adapters with dedicated monitor mode support are inexpensive and widely available, providing a more reliable solution for tasks requiring packet capture.
Frequently Asked Questions
Why does my ARM device not support monitor mode?
Many low-power ARM devices use integrated Wi-Fi chips designed for power efficiency and basic connectivity, lacking the advanced features required for monitor mode. These chips often have fixed firmware that does not expose the necessary registers to the Linux kernel for promiscuous capturing.
Can I force monitor mode with ndiswrapper?
No, ndiswrapper uses Windows drivers on Linux and rarely supports advanced features like monitor mode. It is primarily intended for basic connectivity with hardware that lacks native Linux drivers. Using a native Linux-supported adapter is strongly recommended.
What is the difference between iw set and iw change?
iw dev wlan0 type monitor set was the older syntax, while change is the modern equivalent. Change is preferred because it allows modifying the interface type without necessarily bringing the interface down and up again, reducing the risk of dropping connections unexpectedly during the transition.
How do I know if NetworkManager is blocking my interface?
You can check the status of NetworkManager's control over your interface by running nmcli device status. If the device shows as "connected" or "disconnected" under NetworkManager management, it is likely locking the interface. You can exclude it by setting managed=false in the NetworkManager configuration.
Is error -95 related to IPv6 settings?
No, error -95 in this context is unrelated to IPv6 packet handling. While Explicitly Dropping IPv6 Packets with ip6tables deals with firewall rules, the -95 error specifically arises from the wireless driver layer when an unsupported operation is attempted, such as toggling monitor mode on incompatible hardware.