Alfa AWUS036ACS - Realtek RTL8811AU not working in monitor mode

[pigsfoot]

Hi,

I have just purchased a new Alfa AWUS036ACS USB WiFi adapter to replace an exiting Alfa AWUS036NEH which was only 2.4 Ghz.

The new card ( 36ACS ) seems to have an issue with not working properly in monitor mode. I installed drivers from this link

http://downloads.fars-robotics.net/wifi-drivers/install-wifi

which has loaded the adapter and i now get an wlan0 interface although it has used the 8812au driver

I was originally running kernel 4.19 but have upgraded to 5.4 to see if it makes any difference which it doesn't. I have also noticed that if i down the interface, set the mode to monitor via

iwconfig wlan0 mode monitor 

and bring it back up again, then run iw dev the interface is still shown as managed. However if i run

iw wlan0 set monitor none 

the interface does then show as monitor mode but still no packets captured.

There seems to be a couple of posts here saying they have had similar issues but according to the various reports plus

iw phy 

the adapter does support monitor mode. I presuming the issue is driver related.

Has anyone had a similar issue and managed to get the adapter working, if so how ?

Thanks

[drumbo]

For setting properly monitor mode check this link:

https://github.com/aircrack-ng/rtl8812au/tree/v5.6.4.2

[vom]

I ran into issues with my card today not injecting properly. I finally found this:

https://github.com/aircrack-ng/rtl8812au/issues/819

The second comment contains a patch that makes injecting management frames work again.

In short I did the following:

• Uninstall the Kali package - realtek-rtl88xxau-dkms
• git clone https://github.com/aircrack-ng/rtl8812au/
• In the new rtl8812au directory - download and place the patch referenced in the above issue 819
• patch -p1 < 0001-Allow-inject-management-and-control-frames.txt
• make dkms_install
• I like to reboot here to make sure everything in module land is kosher

After doing this I can now deauth as I could before.

[vom]

So a few updates on this.

Looks like the aircrack repo has this patch officially integrated and committed:

https://github.com/aircrack-ng/rtl88...f989a99c6f3dbe

That commit was on 1/29/21. Looks like the Kali package for this driver is using sources from 1/18/2021. So the Kali package needs a bump to include this (very important) fix:

https://pkg.kali.org/news/439995/rea...-kali-rolling/

So until the realtek-rtl88xxau-dkms package gets bumped to use a more recent/current git snapshot, you'll still need to do what I had in my previous post. However, no need to do the patch anymore as it's been committed.

[vom]

This package was updated today - and it's using a more recent git snapshot. I just uninstalled the aircrack-ng git version I had and installed the Kali package - management frame injection (ex: deauth) seems to be working again.

https://pkg.kali.org/news/447247/rea...-kali-rolling/