probelabs/goreplay · warning

monitor mode error: %q, interface: %q

Error message

monitor mode error: %q, interface: %q

What it means

When config.Monitor is true, PcapHandle calls inactive.SetRFMon to request 802.11 monitor mode. The error is ignored when it matches pcap.CannotSetRFMon (per the errors.Is check), otherwise it is wrapped as "monitor mode error: <err>, interface: <name>". Monitor mode only makes sense on wireless interfaces and requires driver support.

Source

Thrown at internal/capture/capture.go:427

	defer inactive.CleanUp()

	if l.config.TimestampType != "" && l.config.TimestampType != "go" {
		var ts pcap.TimestampSource
		ts, err = pcap.TimestampSourceFromString(l.config.TimestampType)
		fmt.Println("Setting custom Timestamp Source. Supported values: `go`, ", inactive.SupportedTimestamps())
		err = inactive.SetTimestampSource(ts)
		if err != nil {
			return nil, fmt.Errorf("%q: supported timestamps: %q, interface: %q", err, inactive.SupportedTimestamps(), ifi.Name)
		}
	}
	if l.config.Promiscuous {
		if err = inactive.SetPromisc(l.config.Promiscuous); err != nil {
			return nil, fmt.Errorf("promiscuous mode error: %q, interface: %q", err, ifi.Name)
		}
	}
	if l.config.Monitor {
		if err = inactive.SetRFMon(l.config.Monitor); err != nil && !errors.Is(err, pcap.CannotSetRFMon) {
			return nil, fmt.Errorf("monitor mode error: %q, interface: %q", err, ifi.Name)
		}
	}

	var snap int

	if !l.config.Snaplen {
		infs, _ := net.Interfaces()
		for _, i := range infs {
			if i.Name == ifi.Name {
				snap = i.MTU + 200
			}
		}
	}

	if snap == 0 {
		snap = 64<<10 + 200
	}

View on GitHub (pinned to 251e45abd2)

Solutions

1. Only set config.Monitor = true for wireless interfaces (check iface.Flags / driver type)
2. Put the card into monitor mode beforehand (iw dev <iface> set monitor) or use airmon-ng, then capture without the Monitor flag
3. Check the driver supports monitor mode (iw list | grep monitor)
4. Leave the error ignored behavior as-is for CannotSetRFMon and fall back to normal capture

Example fix

// before
cfg.Monitor = true // eth0 -> error
// after
cfg.Monitor = strings.HasPrefix(cfg.Iface, "wlp") && wifiSupportsMonitor(cfg.Iface)

if cfg.Monitor && !strings.HasPrefix(cfg.Iface, "wl") {
    return fmt.Errorf("monitor mode requested on non-wireless interface %q", cfg.Iface)
}

if err != nil && strings.Contains(err.Error(), "monitor mode error") {
    log.Warnf("monitor mode unavailable on %s, continuing in managed mode: %v", ifi.Name, err)
    cfg.Monitor = false
    handle, err = l.PcapHandle(ifi)
}

When it happens

Trigger: Setting l.config.Monitor = true on an interface whose driver/libpcap refuses SetRFMon with an error other than pcap.CannotSetRFMon, e.g. on wired Ethernet or unsupported Wi-Fi drivers.

Common situations: Enabling monitor mode on eth0 by mistake; Wi-Fi chipsets/drivers without monitor support; interfaces managed by NetworkManager that reject mode changes; macOS vs Linux capability differences.

Related errors

• inactive handle error: %q, interface: %q
• %q: supported timestamps: %q, interface: %q
• promiscuous mode error: %q, interface: %q
• snapshot length error: %q, interface: %q
• handle buffer size error: %q, interface: %q

AI-assisted analysis of probelabs/goreplay@251e45abd2 (2026-09-02). Data as JSON: /api/errors/5702c60b14dafb61. Report an issue: GitHub.