Last reviewed 9 min read

Intermediate

Wireless Testing Lab Setup

Build a dedicated wireless testing rig: a monitor-mode adapter, a Kali host or VM that can see it, and a practice access point you own on a channel you control. This page stops when the RF boundary is proven and the adapter injects — the attack walkthroughs run in the Wireless Security guide.

Legal Warning

Only test wireless networks you own or have explicit written authorization to test. Unauthorized wireless interception is illegal in most jurisdictions. Always use an isolated lab environment.

RF Scope Boundary

Use a dedicated practice AP, a known test client, and a channel you control. Stop if captures include unrelated clients, neighboring SSIDs, or traffic outside your written scope.

Isolate First

The RF boundary is an SSID and channel you own, on a segment with no route to your home LAN. A repeater, a mesh node or your home SSID turns cracking practice into unauthorized interception, and deauth or evil-twin tests against anything you do not own are an offence in most jurisdictions.

Network type
Dedicated SSID on an AP you own
Lab network
PentestLab_AP
Subnet
192.168.100.0/24

IP plan

Role IP
Practice access point 192.168.100.1
Test client (owned device) 192.168.100.20 (DHCP pool .10-.50)
Kali monitor-mode adapter no IP — monitor interface

Create it

hostapd / dnsmasq (Linux host)

# /tmp/hostapd.conf: ssid=PentestLab_AP, channel=6, WPA2 with a lab-only passphrase
sudo hostapd /tmp/hostapd.conf
sudo ifconfig wlan1 192.168.100.1 netmask 255.255.255.0
sudo dnsmasq -C /tmp/dnsmasq.conf     # dhcp-range=192.168.100.10,192.168.100.50,12h

Spare router instead

# SSID PentestLab_AP, WPA2, channel 6, LAN 192.168.100.0/24, WAN port unplugged
# Turn off WPS, UPnP and remote management; keep the admin password in the lab notes.

Prove it is isolated

iwgetid -r; ip -4 route

Expected: PentestLab_AP, and the only route is 192.168.100.0/24 via 192.168.100.1. A default route through your home router means the client is still on your home network.

Never run deauth, evil-twin or capture tests against SSIDs or clients you do not own — the RF boundary is a legal boundary, not just a network one.

Lab Runbook

Use this page as a controlled lab build, not a production hardening guide. Prove the network is isolated before running exercises, then validate and clean up from the operational section at the end of the page.

High risk Intermediate 1-2 hr

Plan

4 GB; 20 GB. $30-60 adapter/AP. Isolation: Only your AP, your clients, and your RF test space.

Outcomes

  • - Monitor-mode adapter
  • - Practice AP
  • - Capture workflow
  • - Legal scope notes

Recommended Wireless Adapters

Not all WiFi adapters support monitor mode and packet injection. These adapters are tested and recommended for penetration testing:

Adapter Chipset Bands Monitor Mode Best For
Alfa AWUS036AXML MediaTek MT7921AU 2.4/5/6 GHz (WiFi 6E) ✓ Modern WiFi 6E testing
Alfa AWUS036ACH Realtek RTL8812AU 2.4/5 GHz (AC) ✓ Dual-band, strong range
Alfa AWUS036ACM MediaTek MT7612U 2.4/5 GHz (AC) ✓ Best Linux support, reliable
Panda PAU09 Ralink RT5572 2.4/5 GHz (N) ✓ Budget option, plug & play
TP-Link TL-WN722N v1 Atheros AR9271 2.4 GHz (N) ✓ Classic beginner choice (v1 only)

Version Matters

Many adapters change chipsets between hardware revisions. The TP-Link TL-WN722N v1 uses Atheros AR9271 (great for pentesting), but v2/v3 use Realtek chips that don't support monitor mode without patched drivers. Always verify the chipset before purchasing.

Confirm the Adapter Works For This Lab

Install the lab toolkit, then prove the adapter reaches monitor mode with injection working. That is the whole driver chapter for this page: chipset-specific installs (RTL8812AU via realtek-rtl88xxau-dkms or MycoWave, MediaTek MT7921AU, DKMS and Secure Boot pitfalls), band and channel selection, rfkill fixes and every interface troubleshooting case live in Wireless Interface Setup.

Wireless lab rig and isolation boundary

A monitor-mode adapter passed through to Kali hears every nearby network, while transmit and the hostapd practice AP's test client stay inside the isolated 192.168.100.0/24 lab with no route to the home LAN.

Scroll sideways to see the whole diagram

View full size
Lab Toolkit and Adapter Check 
# Lab tooling: enough to run a practice AP and join it as a client.
# Capture, cracking and rogue-AP commands are taught in /wireless-pentesting/.
sudo apt update && sudo apt install -y \
    aircrack-ng hcxdumptool hcxtools hostapd dnsmasq

# 1. The guest sees the USB adapter (VM readers: do the passthrough step below first)
lsusb | grep -i wireless
iw dev

# 2. Enter monitor mode. Modern airmon-ng often enables it in place, so trust
#    `iw dev` for the real interface name instead of assuming wlan0mon exists.
sudo airmon-ng check kill
sudo airmon-ng start wlan0
iw dev wlan0mon info        # substitute the name iw dev printed; expect "type monitor"

# 3. Injection is a separate capability from monitor mode — test it before any exercise
sudo iw dev wlan0mon set channel 6
sudo aireplay-ng -9 wlan0mon    # expect: "Injection is working!"

# Return the adapter to managed mode when you are done building
sudo airmon-ng stop wlan0mon && sudo systemctl restart NetworkManager

USB Passthrough for VMs

If running Kali in a VM, you must pass the USB WiFi adapter through to the guest.

VMware

  1. VM → Removable Devices → Select adapter
  2. Click "Connect" to pass through
  3. Or: VM Settings → USB Controller → Add USB device
  4. Verify with lsusb in Kali

VirtualBox

  1. Install VirtualBox Extension Pack
  2. Settings → USB → Enable USB 3.0
  3. Add USB device filter for adapter
  4. Start VM — adapter auto-attaches

Practice Access Point Setup

Create your own access point for the lab. Use a second WiFi adapter or a cheap router with OpenWrt for the target AP. The IP plan, the subnet and the isolation reasoning are in the Isolate First block above; this section is the full hostapd build.

Create a WPA2 Practice AP with hostapd 
# Install hostapd
sudo apt install -y hostapd dnsmasq

# Create hostapd config for the lab AP
cat > /tmp/hostapd.conf << 'EOF'
interface=wlan1          # Use second adapter for AP
driver=nl80211
ssid=PentestLab_AP
channel=6
hw_mode=g
ieee80211n=1

# WPA2 with a lab-only passphrase
wpa=2
wpa_passphrase=lab-only-passphrase
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

# Start the access point
sudo hostapd /tmp/hostapd.conf

# In another terminal, set up DHCP for lab clients
cat > /tmp/dnsmasq.conf << 'EOF'
interface=wlan1
dhcp-range=192.168.100.10,192.168.100.50,12h
# no upstream resolver and no default gateway: the AP must not hand a client DNS or a route out
EOF

sudo ifconfig wlan1 192.168.100.1 netmask 255.255.255.0
sudo dnsmasq -C /tmp/dnsmasq.conf

Verify The Lab Is Isolated

Two checks close out the build: the client is on your SSID only, and the monitor adapter is live. Run this from the owned test client after it joins PentestLab_AP.

Isolation and Interface Check 
# On the test client
iwgetid -r                          # expect: PentestLab_AP
ip -4 route                         # expect: only 192.168.100.0/24 via 192.168.100.1
ping -c 1 -W 2 192.168.1.1          # expect: fails — no route to the home LAN

# On the Kali side, monitor mode still up and on your AP's channel
iw dev wlan0mon info | grep type    # expect: type monitor
sudo iw dev wlan0mon set channel 6

Stop If Either Check Fails

A default route through your home router means the client is still on your home network, not the lab. Fix the AP or the client's DHCP before you run any exercise — an RF test that leaks onto the home LAN is no longer an isolated lab.

Where The Technique Walkthroughs Live

The build above stops at a proven adapter and an isolated practice AP. Every technique that uses this rig is taught in the wireless guide, not here: WPA/WPA2 Cracking (handshake capture, PMKID, aircrack-ng and hashcat), Deauthentication (frame injection, client targeting, timing), Evil Twin (rogue AP, captive portal, credential capture) and WPA3, Wi-Fi 6 & Wi-Fi 7 (SAE, transition-mode downgrade, 6 GHz limits). Build the lab here, then run each walkthrough there against this AP, this channel and this test client.

Troubleshooting FAQ

These two cover the lab build itself. Monitor mode not coming up, rfkill, injection failures and a wlan0mon interface that never appears are interface problems, and the interface setup troubleshooting block owns them.

Adapter not detected in Kali VM
  • Ensure USB passthrough is enabled (see VM setup section above)
  • Check lsusb — adapter should appear in the list
  • Try a different USB port (USB 2.0 vs 3.0 can matter)
  • Install VirtualBox Extension Pack for USB 3.0 support
  • Reboot the VM after connecting the adapter
5 GHz networks not showing up
  • Verify adapter supports 5 GHz: iw phy | grep -A 20 "Frequencies"
  • Scan both bands: sudo airodump-ng --band abg wlan0mon
  • Regulatory domain may limit channels: sudo iw reg set US
  • Some 2.4 GHz-only adapters (like TL-WN722N) won't see 5 GHz networks

Readiness And Evidence

What this lab must have before you start, and what to capture so the work is repeatable and reportable.

Minimum Viable Setup

  • One monitor-mode adapter
  • One practice AP you own
  • One known client on a documented channel

Evidence To Capture

  • Adapter chipset and driver output
  • Monitor mode confirmation
  • Capture containing only your test client
  • Written RF scope note

Keep It Fresh

Re-check these against the current release before you trust the lab again.

  • Adapter support Before purchase or rebuild

    Check chipset, revision, kernel, and driver support.

  • WPA3/6E behavior Before exercise

    Confirm region, channel, adapter, and AP support.

Setup Anti-Patterns

Habits that turn a useful lab into an unnecessary risk.

  • Running deauth or evil twin tests near unrelated clients
  • Capturing neighboring SSIDs or clients
  • Assuming 6 GHz testing is legal for every adapter/region

Operational Safety Baseline

Apply these rules before running any lab command on this page.

  • Work only on systems you own or have explicit authorization to test.
  • Keep vulnerable services off your home LAN and off public interfaces.
  • Take clean snapshots before every exercise and before every vulnerable configuration change.
  • Use dedicated cloud accounts, subscriptions, and projects with billing alerts before deployment.
  • Write down the teardown command before you run the setup command.

Validation Checkpoints

  • -Adapter enters monitor mode
  • -AP channel is known
  • -Capture includes your test handshake only

Cleanup And Rollback

  • -Restore NetworkManager
  • -Stop monitor mode
  • -Power down practice AP
  • -Delete captures that include unrelated clients

Practice Next

Wireless Security Use the lab for authorized wireless methodology practice. NetHunter Setup Add a mobile testing platform when the RF lab is stable.

Related Topics

Wireless Security

Full wireless testing methodology

Kali Setup

Configure your Kali attack machine

NetHunter Setup

Mobile wireless testing with Android

Network Security

Broader network security testing