Adapter Injection Failure Under mac80211
You are preparing a Linux laptop for a wireless assessment. lsusb shows a Realtek RTL8812AU adapter (0bda:8812) and an Atheros AR9271 adapter (0cf3:9271). The Realtek uses the out-of-tree 88XXAU driver; the Atheros uses ath9k_htc. You run airmon-ng start wlan0, which creates wlan0mon on the Realtek. aireplay-ng --test wlan0mon reports 'No Answer...' for every injection test. iw dev wlan0mon info shows type monitor, channel 6; dmesg shows firmware loaded. The target AP is a WPA2-PSK 802.11n AP on channel 6 (2437 MHz), and a tablet is associated. You need to capture a 4-way handshake and, if needed, send a targeted deauth. You have root, can reload modules, and have 30 minutes. The AR9271 is currently unused and shows as wlan1.
1. Which adapter should you use for injection and capture, and why? Explain the chipset/driver constraints.
Read the worked answer
Use the AR9271 (ath9k_htc) on wlan1. It is a 2.4 GHz-only radio, but the target is channel 6, and ath9k_htc has mature mac80211 monitor-mode and injection support. The RTL8812AU with 88XXAU is dual-band and can monitor, but its out-of-tree driver/firmware often fails aireplay-ng --test; injection reliability varies by driver build. Since you need a targeted deauth on 2.4 GHz, the AR9271 is the lower-risk choice. Confirm with iw phy phy1 info that 2412 MHz is supported, run airmon-ng start wlan1, and test with aireplay-ng --test wlan1mon. Do not assume the dual-band adapter is better for this job.
2. Give a validation sequence to prove injection works before deauth, and explain what each check rules out.
Read the worked answer
Run airmon-ng check kill to stop NetworkManager/wpa_supplicant from fighting the monitor interface. Run ip link set wlan1 down; iw dev wlan1 set type monitor; iw dev wlan1 set channel 6; ip link set wlan1 up; aireplay-ng --test wlan1. A successful test prints 'Injection is working!' and shows probe responses. If it fails, check rfkill list, iw reg get (set a valid reg domain if 00), dmesg | tail for firmware errors, and iw dev wlan1 info for channel/type. This sequence rules out regulatory restrictions, interface type, channel mismatch, and a userspace manager. Only then run aireplay-ng --deauth 5 -a <AP> -c <client> wlan1.
3. If the AR9271 were unavailable, how would you adapt with the RTL8812AU without relying on injection?
Read the worked answer
Without injection, switch to passive capture: put the RTL8812AU in monitor mode on channel 6 and run airodump-ng with --bssid; wait for a natural 4-way handshake from tablet sleep/wake, roaming, or a controlled reconnect. If the driver supports it, capture a PMKID from EAPOL message 1 by triggering an association, but do not rely on raw injection. If no handshake appears, swap to a known injection-capable adapter (another ath9k/ath9k_htc or a supported 5 GHz adapter) rather than burning the window on a driver that cannot inject. Document the limitation in the report.