树莓派4B上Kali Linux使用iw创建监听接口失败（错误码-52）求助

各位大佬好，我在树莓派4B上运行Kali Linux，尝试创建监听模式的无线接口时遇到了问题：执行命令

iw phy phy0 interface add mon0 type monitor

后直接报错：

command failed: invalid exchange (-52)

我查了网卡的支持情况，iw list输出如下：

Wiphy phy0

wiphy index: 0

max # scan SSIDs: 10

max scan IEs length: 2048 bytes

max # sched scan SSIDs: 16

max # match sets: 16

Retry short limit: 7

Retry long limit: 4

Coverage class: 0 (up to 0m)

Device supports roaming.

Device supports T-DLS.

Supported Ciphers:

* WEP40 (00-0f-ac:1)

* WEP104 (00-0f-ac:5)

* TKIP (00-0f-ac:2)

* CCMP-128 (00-0f-ac:4)

* CMAC (00-0f-ac:6)

Available Antennas: TX 0 RX 0

Supported interface modes:

* IBSS

* managed

* AP

* monitor

* P2P-client

* P2P-GO

* P2P-device

Band 1:

Capabilities: 0x1062

HT20/HT40

Static SM Power Save

RX HT20 SGI

RX HT40 SGI

No RX STBC

Max AMSDU length: 3839 bytes

DSSS/CCK HT40

Maximum RX AMPDU length 65535 bytes (exponent: 0x003)

Minimum RX AMPDU time spacing: 16 usec (0x07)

HT TX/RX MCS rate indexes supported: 0-7

Bitrates (non-HT):

* 1.0 Mbps

* 2.0 Mbps (short preamble supported)

* 5.5 Mbps (short preamble supported)

* 11.0 Mbps (short preamble supported)

* 6.0 Mbps

* 9.0 Mbps

* 12.0 Mbps

* 18.0 Mbps

* 24.0 Mbps

* 36.0 Mbps

* 48.0 Mbps

* 54.0 Mbps

Frequencies:

* 2412 MHz [1] (20.0 dBm)

* 2417 MHz [2] (20.0 dBm)

* 2422 MHz [3] (20.0 dBm)

* 2427 MHz [4] (20.0 dBm)

* 2432 MHz [5] (20.0 dBm)

* 2437 MHz [6] (20.0 dBm)

* 2442 MHz [7] (20.0 dBm)

* 2447 MHz [8] (20.0 dBm)

* 2452 MHz [9] (20.0 dBm)

* 2457 MHz [10] (20.0 dBm)

* 2462 MHz [11] (20.0 dBm)

* 2467 MHz [12] (disabled)

* 2472 MHz [13] (disabled)

* 2484 MHz [14] (disabled)

Band 2:

Capabilities: 0x1062

HT20/HT40

Static SM Power Save

RX HT20 SGI

RX HT40 SGI

No RX STBC

Max AMSDU length: 3839 bytes

DSSS/CCK HT40

Maximum RX AMPDU length 65535 bytes (exponent: 0x003)

Minimum RX AMPDU time spacing: 16 usec (0x07)

HT TX/RX MCS rate indexes supported: 0-7

VHT Capabilities (0x00001020):

Max MPDU length: 3895

Supported Channel Width: neither 160 nor 80+80

short GI (80 MHz)

SU Beamformee

VHT RX MCS set:

1 streams: MCS 0-9

2 streams: not supported

3 streams: not supported

4 streams: not supported

5 streams: not supported

6 streams: not supported

7 streams: not supported

8 streams: not supported

VHT RX highest supported: 0 Mbps

VHT TX MCS set:

1 streams: MCS 0-9

2 streams: not supported

3 streams: not supported

4 streams: not supported

5 streams: not supported

6 streams: not supported

7 streams: not supported

8 streams: not supported

VHT TX highest supported: 0 Mbps

VHT extended NSS: not supported

Bitrates (non-HT):

* 6.0 Mbps

* 9.0 Mbps

* 12.0 Mbps

* 18.0 Mbps

* 24.0 Mbps

* 36.0 Mbps

* 48.0 Mbps

* 54.0 Mbps

Frequencies:

* 5170 MHz [34] (disabled)

* 5180 MHz [36] (20.0 dBm)

* 5190 MHz [38] (disabled)

* 5200 MHz [40] (20.0 dBm)

* 5210 MHz [42] (disabled)

* 5220 MHz [44] (20.0 dBm)

* 5230 MHz [46] (disabled)

* 5240 MHz [48] (20.0 dBm)

* 5260 MHz [52] (20.0 dBm) (no IR, radar detection)

* 5280 MHz [56] (20.0 dBm) (no IR, radar detection)

* 5300 MHz [60] (20.0 dBm) (no IR, radar detection)

* 5320 MHz [64] (20.0 dBm) (no IR, radar detection)

* 5500 MHz [100] (20.0 dBm) (no IR, radar detection)

* 5520 MHz [104] (20.0 dBm) (no IR, radar detection)

* 5540 MHz [108] (20.0 dBm) (no IR, radar detection)

* 5560 MHz [112] (20.0 dBm) (no IR, radar detection)

* 5580 MHz [116] (20.0 dBm) (no IR, radar detection)

* 5600 MHz [120] (20.0 dBm) (no IR, radar detection)

* 5620 MHz [124] (20.0 dBm) (no IR, radar detection)

* 5640 MHz [128] (20.0 dBm) (no IR, radar detection)

* 5660 MHz [132] (20.0 dBm) (no IR, radar detection)

* 5680 MHz [136] (20.0 dBm) (no IR, radar detection)

* 5700 MHz [140] (20.0 dBm) (no IR, radar detection)

* 5720 MHz [144] (20.0 dBm) (no IR, radar detection)

* 5745 MHz [149] (20.0 dBm)

* 5765 MHz [153] (20.0 dBm)

* 5785 MHz [157] (20.0 dBm)

* 5805 MHz [161] (20.0 dBm)

* 5825 MHz [165] (20.0 dBm)

Supported commands:

* new_interface

* set_interface

* new_key

* start_ap

* join_ibss

* set_pmksa

* del_pmksa

* flush_pmksa

* remain_on_channel

* frame

* set_wiphy_netns

* set_channel

* tdls_oper

* start_sched_scan

* start_p2p_device

* connect

* disconnect

* crit_protocol_start

* crit_protocol_stop

* update_connect_params

software interface modes (can always be added):

valid interface combinations:

* #{ managed } <= 1, #{ monitor } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,

total <= 4, #channels <= 2

* #{ managed } <= 1, #{ AP } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,

total <= 4, #channels <= 1

Device supports scan flush.

Device supports randomizing MAC-addr in sched scans.

max # scan plans: 1

max scan plan interval: 508

max scan plan iterations: 0

Supported TX frame types:

* managed: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0

* AP: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0

* P2P-client: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0

* P2P-GO: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0

* P2P-device: 0x00 0x10 0x20 0x30 0x40 0x50 0x60 0x70 0x80 0x90 0xa0 0xb0 0xc0 0xd0 0xe0 0xf0

Supported RX frame types:

* managed: 0x40 0xd0

* AP: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0

* P2P-client: 0x40 0xd0

* P2P-GO: 0x00 0x20 0x40 0xa0 0xb0 0xc0 0xd0

* P2P-device: 0x40 0xd0

Supported extended features:

* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records

* [ 4WAY_HANDSHAKE_STA_PSK ]: 4-way handshake with PSK in station mode

* [ 4WAY_HANDSHAKE_STA_1X ]: 4-way handshake with 802.1X in station mode

* [ DFS_OFFLOAD ]: DFS offload

* [ 4WAY_HANDSHAKE_AP_PSK ]: AP mode PSK offload support

当前网络接口状态（ifconfig输出）：

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500

inet 192.168.0.136  netmask 255.255.255.0  broadcast 192.168.0.255

inet6 2601:644:8000:7cb0:da3a:ddff:fe4a:d95c  prefixlen 64  scopeid 0x0<global>

inet6 fe80::da3a:ddff:fe4a:d95c  prefixlen 64  scopeid 0x20<link>

ether d8:3a:dd:4a:d9:5c  txqueuelen 1000  (Ethernet)

RX packets 6242  bytes 777550 (759.3 KiB)

RX errors 0  dropped 0  overruns 0  frame 0

TX packets 533  bytes 101632 (99.2 KiB)

TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536

inet 127.0.0.1  netmask 255.0.0.0

inet6 ::1  prefixlen 128  scopeid 0x10<host>

loop  txqueuelen 1000  (Local Loopback)

RX packets 80  bytes 6480 (6.3 KiB)

RX errors 0  dropped 0  overruns 0  frame 0

TX packets 80  bytes 6480 (6.3 KiB)

TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500

inet 192.168.0.133  netmask 255.255.255.0  broadcast 192.168.0.255

inet6 2601:644:8000:7cb0::af44  prefixlen 128  scopeid 0x0<global>

inet6 2601:644:8000:7cb0:147a:cfce:1d81:27fc  prefixlen 64  scopeid 0x0<global>

inet6 fe80::cb43:3dd5:3ac3:59b3  prefixlen 64  scopeid 0x20<link>

ether d8:3a:dd:4a:d9:5d  txqueuelen 1000  (Ethernet)

RX packets 3305  bytes 528814 (516.4 KiB)

RX errors 0  dropped 3  overruns 0  frame 0

TX packets 1576  bytes 240534 (234.8 KiB)

TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

从输出能看到网卡明明支持monitor模式，但就是创建失败，有没有大佬能指点下怎么解决？

可能的解决方案（整理自社区经验） #

• 先关闭活跃的无线接口：当前wlan0处于UP状态，可能占用了网卡资源，先执行：

  sudo ip link set wlan0 down
  

  然后再尝试创建监听接口：

  sudo iw phy phy0 interface add mon0 type monitor
  

  创建成功后记得启用接口：

  sudo ip link set mon0 up
  

• 停止NetworkManager服务：如果NetworkManager在管理无线接口，可能会干扰监听模式的创建，执行：

  sudo systemctl stop NetworkManager
  

  之后再重复上面的关闭接口和创建监听接口步骤。

• 重新加载网卡驱动：树莓派4B的无线网卡用的是brcmfmac驱动，尝试卸载再重新加载：

  sudo rmmod brcmfmac && sudo modprobe brcmfmac
  

  等待驱动加载完成后，再执行关闭wlan0和创建监听接口的操作。

• 清理多余接口：从iw list的valid interface combinations可以看到，接口数量和类型有组合限制，如果之前创建过其他接口（比如AP或P2P设备），可能会触发限制，先清理：

  sudo iw dev | grep Interface | awk '{print $2}' | grep -v wlan0 | xargs -I {} sudo iw dev {} del
  

  然后再尝试创建monitor接口。

备注：内容来源于stack exchange