iw

iw is the modern tool for an 802.11 radio (it replaced iwconfig). iw dev wlan0 info prints the card's type (managed for a client, AP for an access point, monitor for a listener), the SSID it serves or has joined, and its channel and frequency. iw dev wlan0 scan does an active scan and lists every BSS on the air — each by its BSSID, signal, frequency and SSID: — which is how two access points sharing one SSID (an evil twin) show up as two addresses. iw dev wlan0 link shows the live association: Connected to <bssid>, or Not connected. A card's type can only be changed while it is down, so set type monitor (deliver every frame, transmit nothing) is preceded by ip link set wlan0 down; set channel then parks the monitor on one channel.

iw command usage

iw dev CARD info|link|scan
iw dev CARD set type managed|monitor
iw dev CARD set channel N

Options

dev wlan0 info

the radio's type, SSID, channel and BSSID

dev wlan0 scan

active scan: every BSS on the air, by BSSID and SSID

dev wlan0 link

the live association, or Not connected

set type monitor

listen-only mode, delivering every 802.11 frame (card must be down)

set channel 6

tune the card to a channel

iw examples

iw dev wlan0 info

Shows whether the radio is a client, an AP or a monitor, and on which channel.

iw dev wlan0 scan

Lists every network on the air by BSSID and SSID: two BSSIDs for one SSID is an evil twin.

iw dev wlan0 link

Shows which BSSID the card is associated to, or that it is not connected.

iw dev wlan0 set type monitor

Puts the radio into monitor mode to capture frames (the card must be down first).

iw dev wlan0 set channel 6

Parks the radio on channel 6.

Pitfalls

• set type monitor fails while the card is up: bring it down with ip link set wlan0 down first.
• A scan answers Resource busy for a moment while the radio is doing something else: retry it.

Run it on real machines