Introduction
Fluxion is a powerful tool for Wi-Fi security auditing. However, its operation significantly alters your system's network state. It typically disables network management services and puts your wireless card into monitor mode to capture traffic. If not properly shut down, or even after a normal exit, your system might be left without internet connectivity.
In this lab, you will learn the essential commands to clean up your system, disable monitor mode, restart network services, and restore your computer to its normal operational state after using Fluxion.
Exit Fluxion Using the Menu or Ctrl+C
In this step, we'll begin the cleanup process. Fluxion is a command-line application. To exit it, you would typically use its built-in menu option for 'Exit' or press Ctrl+C in the terminal where it's running.
For this lab, we will simulate the scenario where Fluxion has already been closed, but the system changes it made are still in effect. You are now at a standard terminal prompt, but your network is likely disconnected.
Let's start by listing the contents of the current directory to see the files Fluxion might have created. All our work will be done in the ~/project directory.
ls -l
You should see a directory named fluxion, which was created by the tool to store its data.
total 4
drwxr-xr-x 3 labex labex 4096 Jun 10 10:20 fluxion
Run 'airmon-ng stop wlan0mon' to Disable Monitor Mode
In this step, we will disable the monitor mode on your wireless interface. Fluxion enables monitor mode to passively listen to all Wi-Fi traffic in the air, which is necessary for its attacks. This mode prevents normal network connections.
The aircrack-ng suite, which Fluxion uses, provides the airmon-ng tool to manage this. When airmon-ng starts monitor mode on an interface like wlan0, it often creates a new virtual interface, typically named wlan0mon. We need to stop this monitor mode interface to revert the wireless card to its standard 'managed' mode.
Run the following command to stop monitor mode on the wlan0mon interface. You need sudo because this is a system-level network change.
sudo airmon-ng stop wlan0mon
The output will confirm that monitor mode has been disabled and the virtual interface has been removed.
PHY Interface Driver Chipset
phy0 wlan0 mac80211_hwsim Software-only virtual MAC
(monitor mode disabled)
Run 'service NetworkManager start' to Restore Network Services
In this step, we will restart the system's network management service. To gain exclusive control over the Wi-Fi card, Fluxion stops the NetworkManager service. This service is responsible for handling all network connections on most modern Linux distributions, including connecting to Wi-Fi networks, managing Ethernet connections, and VPNs.
Without NetworkManager running, your system cannot manage network connections automatically. We need to restart it to restore normal functionality.
Use the service command to start NetworkManager.
sudo service NetworkManager start
This command usually doesn't produce any output if it executes successfully. It will start the NetworkManager process in the background, which will then begin managing your network interfaces again.
Verify Normal Wi-Fi Connectivity is Restored
In this step, we will verify that our network connectivity has been restored. Now that we've disabled monitor mode and restarted NetworkManager, the system should be able to connect to networks as usual.
We can use a few commands to check the status. A very useful tool is nmcli, the command-line interface for NetworkManager.
Run the following command to see the status of all network devices as seen by NetworkManager:
nmcli dev status
The output should show your wireless interface (wlan0) and its state. It might show as disconnected initially, but the key is that it is now being managed.
DEVICE TYPE STATE CONNECTION
wlan0 wifi disconnected --
lo loopback unmanaged --
Next, let's use iwconfig to confirm the operating mode of the wireless interface.
iwconfig wlan0
You should see that the Mode is now Managed, which is the standard mode for connecting to an access point, as opposed to the Monitor mode we had before.
wlan0 IEEE 802.11 ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:on
Remove Temporary Files from the Fluxion Directory if Needed
In this final step, we will clean up the temporary files and directories created by Fluxion. During its operation, Fluxion saves data such as captured handshakes, cracked passwords, and logs into a directory, typically named fluxion.
It's good practice to remove these files after you are done, both to free up disk space and to remove any potentially sensitive information that was captured.
First, let's confirm the fluxion directory exists in our project folder:
ls -l ~/project
Now, use the rm command with the -r (recursive) and -f (force) flags to delete the fluxion directory and all its contents. Be very careful with this command, as it deletes files permanently without confirmation.
rm -rf ~/project/fluxion
After running the command, you can list the contents of the project directory again to verify that the fluxion directory has been removed.
ls -l ~/project
The output should now be empty, confirming the cleanup was successful.
total 0
Summary
In this lab, you learned the critical steps to restore your system's network state after a simulated Fluxion attack. You successfully performed a full cleanup by following a structured process.
You started by understanding how to properly exit the tool. Then, you used sudo airmon-ng stop wlan0mon to disable monitor mode and return your wireless card to its normal operational state. Following that, you restarted the essential NetworkManager service with sudo service NetworkManager start. You then verified that network control was restored using tools like nmcli and iwconfig. Finally, you completed the cleanup by removing the temporary data directory created by Fluxion using rm -rf.
These steps are fundamental for any user of wireless security tools and ensure your system remains stable and connected after your security assessments are complete.
