guide-wifi(7): rtl8812au monitor mode and injection on the whyred NetHunter kernel

DESCRIPTION

This guide covers the WiFi half of NetHunter on the Redmi Note 5 Pro: putting an external RTL8812AU-class adapter into monitor mode and verifying packet injection, using the signed 88XXau module that ships inside the AnyKernel3 zip. Ten minutes once the hardware is right. The classic use is a pocket capture rig: phone, OTG cable, small adapter, done.

One thing to accept before spending money: the internal WCN3980 radio of the whyred can never do monitor mode. That is a firmware limitation, true on every kernel ever built for this device, not something a kernel update fixes. External adapter or nothing.

HARDWARE

Adapter: anything on RTL8812AU, RTL8821AU or RTL8814AU. The ALFA AWUS036ACH is the usual choice and the one the module gets tested with. Same chipset family means same driver.
OTG cable or hub: the adapter pulls real current on both bands. A plain OTG cable works for capture, but for sustained injection or an external antenna at high power, a powered OTG hub keeps the phone from browning out.
Power bank with pass-through is a good middle ground: charges the phone while the adapter hangs off OTG.

SETUP

With the kernel already flashed (guide-install(7)), plug the adapter into OTG. The 88XXau module is signed and shipped in the zip, the loader picks it up by modalias on plug. Confirm the interface exists:

$ adb shell su -c ip link show
...
wlan1: ... link/ether 00:c0:ca:...

wlan1 with an ALFA-prefix MAC is the adapter. If it does not appear, load the module by hand and read the log:

$ adb shell su -c insmod /system/lib/modules/88XXau.ko
$ adb shell su -c dmesg | tail

Module signature failures in dmesg mean the zip and the kernel do not match: you flashed a module from a different build. Use the zip from the same release as the running kernel, they are signed with the same key on purpose.

MONITOR MODE

$ adb shell su -c "ip link set wlan1 down"
$ adb shell su -c "iw dev wlan1 set type monitor"
$ adb shell su -c "ip link set wlan1 up"
$ adb shell su -c "iw dev wlan1 info"

The last line should report type monitor. From the Kali chroot (or a terminal with the NetHunter userland), capture:

$ sudo airodump-ng wlan1 -w /sdcard/cap

Both bands work: 2.4 GHz and 5 GHz, which is the whole point of paying for a dual band adapter.

INJECTION TEST

$ sudo aireplay-ng -9 wlan1

Read the line that matters: Injection is working! If it says otherwise, in this order: try a powered hub (current dip looks exactly like a failed test), try another USB port on the adapter side (cables again), and check that no NetHunter-managed wifi connection is holding the interface. Injection on networks you do not own is not a test, it is an attack: test against your own AP.

BACK TO MANAGED

$ adb shell su -c "ip link set wlan1 down"
$ adb shell su -c "iw dev wlan1 set type managed"
$ adb shell su -c "ip link set wlan1 up"

Or just unplug the adapter. Nothing in the phone changes, the internal wifi stays on the ROM side the whole time.

BUGS

Country code defaults to the driver default, set yours with iw reg set if channel 12/13 or DFS channels look missing.
The adapter sometimes enumerates as wlan2 after a hot unplug without down: rename or reboot, cheaper than debugging udev.
MT7612U / MT7921AU class adapters are a different driver and are NOT in the zip. Chipset first, brand second.

guide-wifi(7)