1 How it works
iw sends netlink messages to the kernel (nl80211) which in turn talks to cfg80211/mac80211 and the driver.
That’s why output is detailed and operations map closely to kernel concepts like phy, dev,
interface, station, and regulatory.
- phy: a physical radio (e.g., phy0)
- dev: a network interface bound to a phy (e.g., wlan0)
- station: an associated client/AP peer
- regdom: regulatory domain constraints (channels/power)
# Map the landscape
iw phy
iw dev
ip link show wlan0
2 10 practical examples
These are safe, common patterns you’ll use in day-to-day troubleshooting and configuration.
# 1) List wireless devices and interfaces
iw dev
iw phy
# 2) Show info for a specific interface
iw dev wlan0 info
# 3) Scan for networks (SSID, signal, etc.)
sudo iw dev wlan0 scan | less
# 4) Show current link status (associated AP, bitrate, signal)
iw dev wlan0 link
# 5) Show station stats (RX/TX bytes, retries, signal)
sudo iw dev wlan0 station dump
# 6) Disconnect from current network
sudo iw dev wlan0 disconnect
# 7) Set regulatory domain (affects channels + TX power)
sudo iw reg set US
iw reg get
# 8) Set the channel / frequency (useful for monitor/AP workflows)
sudo iw dev wlan0 set channel 36
sudo iw dev wlan0 set freq 5180
# 9) Create a monitor interface (for captures with tcpdump/wireshark)
sudo iw dev wlan0 interface add mon0 type monitor
sudo ip link set mon0 up
# 10) Remove the monitor interface when done
sudo iw dev mon0 del
Connecting to WPA/WPA2/WPA3 is usually done via wpa_supplicant or NetworkManager, not directly with iw.
Use iw for inspecting/steering; use the supplicant/manager to authenticate.
3 Notes & gotchas
- Permissions: Many commands need root (netlink operations that change state).
- Interface state: Some operations require the interface to be UP.
- Regulatory: Setting regdom may be overridden by driver/firmware, CRDA rules, or userspace managers.
- Scanning is noisy: Frequent scans can disrupt throughput or power-saving behavior.
- Monitor mode: Not all chipsets/drivers support monitor/injection equally.
- Channel/freq: Changing channel on a managed interface can disconnect you (expected).
# Bring interface up (if needed)
sudo ip link set wlan0 up
# If scan fails: check rfkill and driver state
rfkill list
sudo rfkill unblock wifi
dmesg | tail -n 50
4 Historical context
Before iw, Linux commonly used wireless-tools:
iwconfig, iwlist, and friends. Those tools target the old Wireless Extensions (WEXT),
which lack many modern 802.11 capabilities.
Old: Wireless Extensions (WEXT)
iwconfig
iwlist wlan0 scan
New: nl80211/cfg80211 via iw
iw dev
sudo iw dev wlan0 scan
Modern distros still ship iwconfig in some cases, but for anything beyond basics, prefer iw.
5 Modern equivalents and companions
In practice, you’ll mix iw with higher-level tools depending on what you’re doing:
- nmcli / NetworkManager — manage connections, SSIDs, credentials, profiles
- wpa_supplicant — WPA/WPA2/WPA3 authentication and roaming
- ip — interface state, addresses, routes
- rfkill — unblock radios
- ethtool — driver/module stats (not Wi‑Fi specifics, but useful)
# Example: observe link while managing via NetworkManager
nmcli dev wifi list
nmcli dev wifi connect "SSID" password "PASSWORD"
iw dev wlan0 link
6 Related commands
- ip — links, addresses, routes
- nmcli — NetworkManager CLI
- wpa_cli — control wpa_supplicant
- rfkill — airplane-mode blocks
- iwconfig — legacy WEXT (historical)
- tcpdump — packet capture (especially with monitor interfaces)
# Capture on monitor interface
sudo tcpdump -i mon0 -nn -s0 -w capture.pcap