I'm using an adapter with Realtek's rtl8812au WiFi 5 (802.11ac) chipset and
tshark -i wlan0 -I
prompts:
tshark: The capture session could not be initiated on capture device "wlan0" (That device doesn't support monitor mode).
I did put the adapter in monitor mode via ifconfig wlan0 down && airmon-ng check kill && iwconfig wlan0 mode monitor &&
ifconfig wlan0 up
as well as:
ip link set wlan0 down &&
iw wlan0 set monitor control &&
ip link set wlan0 up
both iwconfig and iw dev did show wlan0 in monitor mode and I know for sure the adapter supports monitor mode, I also believe I got the correct driver (realtek-rtl88xxau-dkms)
Kernel: Linux 5.18.0-kali7-amd64
Wireshark 3.6.6 (Git v3.6.6 packaged as 3.6.6-1)
When I use the Wireshark GUI there is not even a checkbox present in the monitor mode column, according to the FAQ this indicates that Wireshark doesn't recognize the adapters rfmon capability and the wiki states that the most likely cause is a bug in libpcap, I checked versions with:
apt list --installed | grep libpcap:
libpcap-dev/unknown,now 1.10.1-4 amd64 [installed]
libpcap0.8-dev/unknown,now 1.10.1-4 amd64 [installed,automatic]
libpcap0.8/unknown,now 1.10.1-4 amd64 [installed,automatic]
and then reinstalled the library, after:
apt-get -y autoremove --purge libpcap-dev
still the same, no rfmon..
Any solutions or ideas what I could try next?