Extra Long MAC address with Monitor mode.

[xNotta]

I noticed that once I enter my wifi card into monitor mode the mac address becomes much longer.

Same result whether I use airmon-ng or iwconfig mode monitor to put it into monitor mode.

Could anyone tell me if this is normal? or how I can fix it?


root@kali:~# ifconfig

wlan2 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

root@kali:~# airmon-ng check kill
Killing these processes:

PID Name
1706 wpa_supplicant

root@kali:~# airmon-ng start wlan2
No interfering processes found
PHY Interface Driver Chipset

phy3 wlan2 rt2800usb Ralink Technology, Corp. RT3572
(mac80211 monitor mode vif enabled for [phy3]wlan2 on [phy3]wlan2mon)
(mac80211 station mode vif disabled for [phy3]wlan2)


root@kali:~# ifconfig

wlan2mon Link encap:UNSPEC HWaddr XX-XX-XX-XX-XX-XX-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3 errors:0 dropped:3 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:285 (285.0 B) TX bytes:0 (0.0 B)

root@kali:~#

[grid]

I don't have my wifi card at present, so I can't verify. Can you sniff packets and inject ok?

What's the make & model of your wifi card?

[xNotta]

I don't have my wifi card at present, so I can't verify. Can you sniff packets and inject ok?

What's the make & model of your wifi card?

I'm using an ALFA AWUS051NH with the RT3572 chipset.
Airodump-ng displays networks and beacon count goes up.
Wash gives an error that's corrected with -C.
and I can't get Reaver to associate with a WPS enabled AP with signal at about -50.
Airbase-ng gives a segmentation fault after running for a few seconds.

My mac goes from XX:XX:XX:XX:XX:XX to XX-XX-XX-XX-XX-XX-00-00-00-00-00-00-00-00-00-00 once monitor mode is enabled and the interface is brought up.
I think that might be causing a problem with Reaver associating?

I'm still learning so I don't really know how to test sniffing and injection.

[reidamaxia]

Hi there

I think it's normal! Mine does it too.. and I can sniff perfectly!
I did a quick research too and found this: http://www.backtrack-linux.org/forums/showthread.php?t=43071
Just in case you want to change your mac address.

Hope it helps!

Best regards, reidamaxia

[mmusket33]

This is normal ifconfig output.

But if you want to see what actual mac address is being broadcast from your device place your wifi device in monitor mode.

Point airodump-ng at an association point

airodump-ng -c ? --bssid 55:44:33:22:11:00 mon0

Now use aireplay-ng to do a fake auth against the AP

aireplay-ng -1 10 -a 55:44:33:22:11:00 mon0

You will see the mac you are broadcasting in airodump-ng

MTeams

[grid]

Sounds like your card is in monitor mode ok, if airodump is seeing APs and collecting packets. You can test for packet injection by running aireplay-ng -9 [interface in monitor mode]