iw Command Guide 2026: Enable Monitor Mode, Scan Networks, Fix Device Busy Error

iw is the modern replacement for iwconfig, which has been deprecated for years and is no longer maintained. While iwconfig relied on the legacy Wireless Extensions (WEXT) kernel API, iw communicates with the kernel through nl80211 (Netlink 802.11) and cfg80211, giving it full access to the capabilities of modern wireless drivers.

In Kali Linux, iw is the standard tool for configuring wireless interfaces before running tools like aircrack-ng, airodump-ng, or hostapd-wpe. On Ubuntu and other general-purpose distributions it handles everyday tasks like scanning for networks and checking link status. This guide focuses on monitor mode — the most common reason people reach for iw on a security-testing system — and covers the specific error messages that appear when the setup goes wrong.

Prerequisites

• Linux system with a wireless adapter (Kali Linux 2024.1+ or Ubuntu 22.04/24.04)
• A wireless adapter that supports monitor mode. Common choices for penetration testing include the Alfa AWUS036ACM and AWUS036ACHM, both of which have in-tree Linux drivers and reliable monitor mode support
• Root access or sudo privileges
• iw installed — it is present by default on Kali Linux and available as sudo apt install iw on Ubuntu

Check your wireless interface name

Modern Linux systems use predictable network interface names (e.g. wlp3s0, wlx00c0ca9f1234) rather than the traditional wlan0. Kali Linux 2024+ typically still uses wlan0 for the first wireless adapter, but external USB adapters often get longer names based on MAC address.

iw dev

Sample output:

phy#0
    Interface wlan0
        ifindex 3
        wdev 0x1
        addr aa:bb:cc:dd:ee:ff
        type managed
        channel 6 (2437 MHz), width: 20 MHz, center1: 2437 MHz

You can also use ip link show to list all network interfaces and identify the wireless ones by name pattern:

ip link show

Use the interface name shown in iw dev output in all subsequent commands. The examples below use wlan0.

Enable monitor mode

Monitor mode allows the wireless adapter to capture all 802.11 frames in the air, not just frames addressed to it. This is required for tools like airodump-ng, tcpdump over WiFi, and scapy-based packet analysis.

# Step 1: bring the interface down
sudo ip link set wlan0 down

# Step 2: set monitor mode
sudo iw dev wlan0 set type monitor

# Step 3: bring the interface back up
sudo ip link set wlan0 up

Verify that monitor mode is active:

iw dev wlan0 info

When monitor mode is correctly enabled, the output includes type monitor:

Interface wlan0
    ifindex 3
    wdev 0x1
    addr aa:bb:cc:dd:ee:ff
    type monitor
    channel 1 (2412 MHz), width: 20 MHz (no HT), center1: 2412 MHz

If the type line still reads managed, the mode change did not take effect — most likely because NetworkManager reactivated the interface. See the next section.

Fix: "SET failed on device wlan0 ; Device or resource busy" (error 8B06)

This is the most common error when running iw dev wlan0 set type monitor. The full message looks like:

command failed: Device or resource busy (-16)

or in older kernel/driver versions:

Error for wireless request "Set Mode" (8B06) : SET failed on device wlan0 ; Device or resource busy.

The cause is that NetworkManager (or wpa_supplicant) still holds the interface and will not allow mode changes while it is active.

Option A: Kill interfering processes with airmon-ng (recommended for Kali Linux)

airmon-ng check kill identifies and terminates all processes that are known to interfere with monitor mode, including NetworkManager and wpa_supplicant.

sudo airmon-ng check kill

Then retry the monitor mode sequence:

sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

Option B: Stop NetworkManager temporarily (works on all distributions)

sudo systemctl stop NetworkManager
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

Remember to restart NetworkManager when you are finished, or your other network connections will not work.

If neither option resolves the error, check whether wpa_supplicant is running separately:

sudo pkill wpa_supplicant
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

Revert to managed mode

When you are done with monitor mode, restore the interface to managed mode so that NetworkManager can use it again for normal network connectivity.

sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up
sudo systemctl start NetworkManager

If you used airmon-ng check kill earlier, you will also need to restart wpa_supplicant. On most systems, restarting NetworkManager brings it back automatically. You can verify with:

iw dev wlan0 info

The type line should now read managed.

Scan for networks

In managed mode, you can use iw to perform an active scan and list nearby access points.

sudo iw dev wlan0 scan

The full output is verbose. To extract the most useful fields:

sudo iw dev wlan0 scan | grep -E "SSID:|signal:|freq:"

Sample output:

    freq: 2412
    signal: -62.00 dBm
    SSID: HomeNetwork
    freq: 5180
    signal: -71.00 dBm
    SSID: OfficeWifi_5G

Note: scanning requires the interface to be in managed mode (or monitor mode with a capable driver). If the scan returns no results, check that the interface is up with ip link show wlan0 and that you have root privileges.

Create a virtual monitor interface (advanced)

Instead of switching wlan0 into monitor mode directly, you can create a second virtual interface in monitor mode while leaving the original interface in managed mode. This is useful when you want to capture packets on one interface while maintaining a normal network connection on another.

# Create mon0 as a monitor interface without changing wlan0
sudo iw dev wlan0 interface add mon0 type monitor
sudo ip link set mon0 up

The new mon0 interface can now be used with tcpdump, airodump-ng, or any other tool that accepts an interface name:

sudo airodump-ng mon0

When you are done, delete the virtual interface:

sudo iw dev mon0 del

Note that not all drivers support multiple concurrent virtual interfaces. If the interface add command returns an error, your driver does not support this feature and you will need to use the direct method described earlier.

iw vs iwconfig vs airmon-ng

airmon-ng start wlan0 is often the easiest approach in Kali Linux because it handles the NetworkManager conflict automatically. Under the hood it calls iw (or the equivalent ip link + driver commands). Understanding the manual iw method is useful when airmon-ng is not available or when you need more precise control over the interface configuration.

Quick reference

Related articles

• How to solve iwconfig Device or resource busy
• iwconfig vs iw: Which WiFi Command to Use in Linux 2026
• aircrack-ng WPA2 handshake tutorial
• rtl8812au Kali Linux 2026 monitor mode setup