Alfa AWUS036ACS - Realtek RTL8811AU not working in monitor mode

[pigsfoot]

Hi,

I have just purchased a new Alfa AWUS036ACS USB WiFi adapter to replace an exiting Alfa AWUS036NEH which was only 2.4 Ghz.

The new card ( 36ACS ) seems to have an issue with not working properly in monitor mode. I installed drivers from this link
http://downloads.fars-robotics.net/wifi-drivers/install-wifi which has loaded the adapter and i now get an wlan0 interface although it has used the 8812au driver

I was originally running kernel 4.19 but have upgraded to 5.4 to see if it makes any difference which it doesn't. I have also noticed that if i down the interface, set the mode to monitor via
iwconfig wlan0 mode monitor and bring it back up again, then run iw dev the interface is still shown as managed. However if i run
iw wlan0 set monitor none the interface does then show as monitor mode but still no packets captured.

There seems to be a couple of posts here saying they have had similar issues but according to the various reports plus
iw phy the adapter does support monitor mode. I presuming the issue is driver related.

Has anyone had a similar issue and managed to get the adapter working, if so how ?

Thanks

[drumbo]

For setting properly monitor mode check this link:

https://github.com/aircrack-ng/rtl8812au/tree/v5.6.4.2

[vom]

I ran into issues with my card today not injecting properly. I finally found this:

https://github.com/aircrack-ng/rtl8812au/issues/819

The second comment contains a patch that makes injecting management frames work again.

In short I did the following:


Uninstall the Kali package - realtek-rtl88xxau-dkms
git clone https://github.com/aircrack-ng/rtl8812au/
In the new rtl8812au directory - download and place the patch referenced in the above issue 819
patch -p1 < 0001-Allow-inject-management-and-control-frames.txt
make dkms_install
I like to reboot here to make sure everything in module land is kosher

After doing this I can now deauth as I could before.

[vom]

So a few updates on this.

Looks like the aircrack repo has this patch officially integrated and committed:

https://github.com/aircrack-ng/rtl8812au/pull/823/commits/46179742bd7b56450aea90d99ff989a99c6f3dbe

That commit was on 1/29/21. Looks like the Kali package for this driver is using sources from 1/18/2021. So the Kali package needs a bump to include this (very important) fix:

https://pkg.kali.org/news/439995/realtek-rtl88xxau-dkms-5642git20210118-0kali1-migrated-to-kali-rolling/

So until the realtek-rtl88xxau-dkms package gets bumped to use a more recent/current git snapshot, you'll still need to do what I had in my previous post. However, no need to do the patch anymore as it's been committed.

[vom]

This package was updated today - and it's using a more recent git snapshot. I just uninstalled the aircrack-ng git version I had and installed the Kali package - management frame injection (ex: deauth) seems to be working again.

https://pkg.kali.org/news/447247/realtek-rtl88xxau-dkms-5642git20210327c0ce817-0kali1-migrated-to-kali-rolling/