We will assume that the wireless client has a network Wireless Lab configured on it, and it actively sends Probe Requests for this network, when it is not connected to any access point. In order to find the security configuration of this network, we will need to create multiple access points. For our discussion, we will assume that the client profile is an open network, WEP protected, WPA-PSK, or WPA2-PSK. This means we will have to create four access points. To do this, we will first create four virtual interfaces—mon0 to mon3, using the airmon-ng start wlan0 command multiple times:

You can view all these newly created interfaces using the ifconfig –a command:

Now we will create the open AP on mon0:

Let's create the WEP protected AP on mon1:

The WPA-PSK AP will be on mon2:

WPA2-PSK AP will be on mon3:

We can run airodump-ng on the same channel to ensure that all four access points are up and running, as shown in the following screenshot...