Set monitor mode for interface

“-I/--monitor-mode“ option is used to put network interface in “monitor mode” through pcap_set_rfmon API (code is here): 

  1. ......
  2. if (Iflag) {
  3.     status = pcap_set_rfmon(pc, 1);
  4.     if (status != 0)
  5.         error("%s: Can't set monitor mode: %s",
  6.             device, pcap_statustostr(status));
  7. }
  8. ......

Definitely, the interface should support “monitor mode” first, otherwise, following error message will be outputted: 

  1. # tcpdump -I
  2. tcpdump: enp0s3: That device doesn't support monitor mode