Enabling the monitor mode

To be able to sniff the probe requests, your Wi-Fi network interface must be set to monitor mode.

With ifconfig and iwconfig

sudo ifconfig <wireless interface> down
sudo iwconfig <wireless interface> mode monitor
sudo ifconfig <wireless interface> up

For example:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ifconfig wlan0 up

With airmon-ng from aircrack-ng

To kill all the interfering processes:

sudo airmon-ng check kill

To enable the monitor mode:

sudo airmon-ng start <wireless interface>

For example:

sudo airmon-ng start wlan0

Command line arguments

Toolkit for Playing with Wi-Fi Probe Requests

usage: probequest [-h] [--debug] [--fake] -i INTERFACE [--ignore-case]
                  [--mode {raw,pnl}] [-o OUTPUT_FILE] [--version]
                  [-e ESSID_FILTERS [ESSID_FILTERS ...] | -r ESSID_REGEX]
                  [--exclude MAC_EXCLUSIONS [MAC_EXCLUSIONS ...] | -s
                  MAC_FILTERS [MAC_FILTERS ...]]

Named Arguments


debug mode

Default: False


display only fake ESSIDs

Default: False

-i, --interface

wireless interface to use (must be in monitor mode)


ignore case distinctions in the regex pattern (default: false)

Default: False


Possible choices: raw, pnl

set the mode to use

Default: raw

-o, --output

output file to save the captured data (CSV format)


show program’s version number and exit

-e, --essid

ESSID of the APs to filter (space-separated list)

-r, --regex

regex to filter the ESSIDs


MAC addresses of the stations to exclude (space-separated list)

-s, --station

MAC addresses of the stations to filter (space-separated list)

Example of use

sudo probequest -i wlan0

Here is a sample output: