Whenever I start wireshark in monitor mode:
sudo wireshark -I -i wlan0 -kSl
The capture ends in 15 seconds, because the adapter disconnects from the network. syslog says: wpa_supplicant CTRL_EVENT_SIGNAL_CHANGE
I've tried Ubuntu 19 and Kali and get the same result.
If I don't connect to the AP, it works fine.
Any idea why this happens?
I think you have interfering processes which take control of the NIC and return it to managed mode. This is known behavior - the airmon-ng script for preparing an interface for monitor mode support includes tools to handle this case. See:
https://www.aircrack-ng.org/doku.php?id=airmon-ng
There are ways to create a virtual adapter and capture as well as use the main adapter in managed mode. I usually suggest not to do this - strongly prefer an independent adapter dedicated for capture.
Thanks for that tip. The aircrack script is useful, but still does not work for me with one adapter to solve this particular problem. When it puts it into monitor mode, network manager then sees no wireless interfaces to use, so you can't connect anymore. But you can at least monitor for more than 15 seconds without getting disconnected.
I ended up following your advice and got a second adapter to use as a monitor and that works fine.
Comments
Please do NOT run Wireshark as root, see the Security wiki page for reasons why. Instead adjust the capture privileges, see here for more info.