How Wi-Fi Works

Every Wi-Fi attack you will ever run depends on one thing: a card that can listen to raw radio, not just the traffic addressed to it. Get that working and the rest is mechanical. Skip it and nothing else in this module functions, so we start here.

Wi-Fi is IEEE 802.11. An access point (AP) broadcasts a network name, the SSID, and identifies itself by its MAC address, the BSSID. Clients associate to the BSSID, not the name, which matters later when two APs advertise the same SSID. One is real, one is yours.

Channels and bands

802.11 splits the spectrum into channels. The 2.4 GHz band has channels 1 through 14, but only 1, 6, and 11 do not overlap, so most APs sit on one of those three. The 5 GHz band has far more non-overlapping channels, which is why modern networks prefer it.

This matters for capture. Your card hears exactly one channel at a time. If the AP is on channel 6 and you are parked on channel 1, you hear nothing. Every capture tool either locks to a channel or hops across them, and picking the wrong channel is the most common reason a beginner sees an empty screen.

The three frame types

802.11 traffic comes in three flavors, and the offensive value is lopsided.

Data frames carry the actual payload, your web traffic, encrypted under WPA2. Control frames handle medium access, things like ACKs and RTS/CTS. Management frames run the network: beacons that announce the SSID, probe requests from clients hunting for known networks, association requests, and deauthentication frames.

Management frames are the interesting ones. In WPA2 they are unauthenticated, which is the whole reason a deauth attack works: you forge a management frame telling a client to disconnect, and it obeys. That single design gap feeds the handshake capture in a later lesson.

Monitor mode

Normal ("managed") mode makes the card behave like a client. It only surfaces frames meant for it and it will not inject. Monitor mode hands you every frame in the air on the current channel, and with the right chipset it lets you transmit crafted frames too. That is the mode you need.

Kill the processes that fight you for the card first, then flip the mode with airmon-ng.

If type still says managed, the mode did not take. Nine times out of ten it is a chipset that does not support monitor mode. Not every USB adapter does. The reliable ones in the field use Atheros AR9271 or Ralink RT3070/RT5370, which is why the Alfa AWUS036 line is the standard recommendation.

To undo it and get your normal connection back, run sudo airmon-ng stop wlan0mon then sudo systemctl restart NetworkManager.