Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.