If you just want to monitor traffic from your connection while you are connected to wifi, you don't need to use monitor mode.
Also, NetworkManager won't connect to your wifi AP if the device is in monitor mode, it has to be in managed mode to be managed by NetworkManager.
First, run the following command to get back into managed mode:
sudo iwconfig <device> mode managed
and then restart NetworkManager:
sudo systemctl restart NetworkManager
This should connect you back to your wifi network access point or at least you should be able to select your access point from the list of available networks to connect if it doesn't connect automatically.
So if you just want to monitor traffic to and from your device, you can simply run wireshark:
sudo -i wireshark
and then select your interface from the list of devices. Example: wlp1s0
It should start capturing traffic.
Now if you really want to use monitor mode, you can create a separate virtual interface in monitor mode.
Use the following to list your devices:
iw dev
This should show something like phy#0
.
Using phy#0
as an example, we would use phy0
in the following command to add a monitor device named mon0
:
sudo iw phy phy0 interface add mon0 type monitor
Now, bring the device up:
sudo ifconfig mon0 up
At this point, you can stop NetworkManager and run Wireshark in wireless monitor mode:
sudo systemctl stop NetworkManager
sudo -i wireshark
and select mon0
from your list of interfaces.
You will not be able to use the internet from your device without NetworkManager but you will be sniffing all kinds of traffic monitored from other devices broadcasting within range.
It is possible to monitor using mon0
while using NetworkManager to connect to the internet through wlp1s0
or whatever your regular wireless device is. But I don't think that is ideal and when I've done this, it doesn't seem to sniff all the other devices broadcasting within range.
Also, when you're done using Wireshark, you can delete your monitor device:
sudo iw dev mon0 del