Run airodump-ng and identify your own lab AP by BSSID and channel
Capture 60 seconds of traffic to a .cap file and open it in Wireshark
Identify at least one beacon frame and one probe request in the capture
In-scope
Your own lab AP only — do not scan or capture traffic from any network you do not own
Rules of engagement
Passive observation only in this lab — no injection or deauthentication yet. Confirm you can identify your lab AP's BSSID before continuing to later modules.
Walkthrough
Start by confirming Linux actually sees your adapter before you touch anything else:
bash
lsusb
Look for your chipset's vendor and product ID in the list (an Alfa AWUS036NHA shows up as 0cf3:9271, Atheros Communications, Inc.). If it is not there at all, this is a USB connection or cabling problem, not a driver problem. Try a different port, and if you are in a virtual machine, check that the device is actually attached in your hypervisor's USB settings before going further.
Next, confirm the driver picked it up:
bash
sudo airmon-ng
This prints a table: interface name, chipset, driver. You want to see your card listed with the driver you expect (ath9k_htc, rt2800usb, or 88XXau/rtl8812au, depending on your chipset). If the interface does not show up here even though lsusb sees it, check dmesg | tail -40 for driver load errors. This is the most common place Realtek chipset users get stuck, usually because of a DKMS build failure against a newer kernel version.
Rendering diagram…
Step 1: kill the interference
bash
sudo airmon-ng check kill
This stops NetworkManager and wpa_supplicant from fighting you for the interface. If you need internet during this lab, make sure it is coming from Ethernet or a second connection, not from the card you are about to repurpose for monitor mode.
Step 2: enable monitor mode
bash
sudo airmon-ng start wlan0
Confirm it worked:
bash
iwconfig
You should see an interface (either wlan0mon, or wlan0 renamed in place, depending on your driver) reporting Mode:Monitor. If you do not see this, go back to the previous lesson's troubleshooting section before continuing. Nothing past this point works without it.
Step 3: your first live capture
Point airodump-ng at the interface with no filters yet, just to see what is actually in the air around you:
bash
sudo airodump-ng wlan0mon
You will get a live updating table. The top half lists access points (BSSID, power, beacon count, channel, encryption, and network name); the bottom half lists client devices, showing which BSSID each one is talking to. Let it run for 20 to 30 seconds. It is hopping across 2.4 GHz channels by default, so you are getting a snapshot of everything nearby, one channel at a time.
Note
The PWR column is signal strength in dBm. Closer to 0 means a stronger signal (a PWR reading of -30 is very strong and very close, while -80 is weak, near the edge of range). It is not a linear scale, and it is noisy from frame to frame, but watching it over a few seconds gives you a real sense of physical distance without ever leaving your chair.
Step 4: lock onto one target and channel
Pick a BSSID from the sweep (your own lab access point) and note its channel. Broad sweeps waste capture time hopping between channels you do not care about, so narrow it down:
-c 6 pins the channel (swap in whatever your access point is actually on), --bssid filters the display to just that network, and -w firstcapture starts writing capture files to disk with that prefix. Let this run for a minute or two, ideally while a client on your lab network does something (browses the web, sends traffic), so you are capturing more than idle beacons.
Step 5: stop and inspect what you captured
Press Ctrl+C to stop, then check what got written:
bash
ls firstcapture*
You will see several files: firstcapture-01.cap (the actual packet capture, readable by Wireshark or aircrack-ng), firstcapture-01.csv (a summary of access points and clients seen), and firstcapture-01.kismet.csv/.netxml (exports compatible with the Kismet tool you will meet later). The .cap file is the one that matters going forward. Open it in Wireshark:
bash
wireshark firstcapture-01.cap
Filter for wlan.fc.type_subtype == 0x08 to isolate beacon frames, or wlan.bssid == aa:bb:cc:dd:ee:ff to see everything tied to your target access point specifically. Look at an actual beacon frame's details pane. You will see the network name, supported rates, and the RSN information element (the field that advertises WPA2/WPA3 cipher suites) laid out in full. It is worth doing this once by hand so you understand what airodump-ng's summary columns are actually reading off the wire.
Troubleshooting
Capture file has beacons but zero data packets: this is normal if no client is actively passing traffic on the target network during your capture window. Generate some yourself by having a device browse on the lab access point, or extend the capture duration.
airodump-ng shows the access point but PWR is always -1: some drivers do not report signal strength correctly over monitor mode. This is a driver quirk, not a sign anything is broken. Check the .cap file in Wireshark instead. If frames are present with reasonable content, your capture is fine even if the live PWR column is wrong.
Channel keeps jumping even though you set -c: double check you did not accidentally leave a channel hopping instance of airodump-ng running in another terminal on the same interface. Only one process should control the radio's channel at a time.
"fixed channel wlan0mon: -1" in the airodump-ng header: this specific message is usually harmless bookkeeping output, not an actual error. But if captures genuinely are not updating alongside it, re-verify with iw dev wlan0mon info that the interface is still in monitor mode, since some drivers silently drop back to managed mode under load.
With a real .cap file on disk and a basic mental model of what is inside it, you are set up for the next module. Instead of a single ad-hoc capture, you will run a structured, deliberate recon sweep the way you would actually scope a target network before attacking anything.
Sign in to track progress, submit flags, and take notes.