wavemon puts a live wireless link on one ncurses screen

One ncurses screen for a wireless link

wavemon turns a terminal into a scope for a wireless link. The project describes itself as an ncurses-based monitoring application for wireless network devices on Linux, and it lets you watch signal and noise levels, packet statistics, device configuration and network parameters of your wireless hardware. That is a narrower promise than a packet capture suite and a different one from a general network scanner. The reader who benefits is anyone on a Linux box who needs to see what the radio is doing right now, whether that is a laptop on a noisy office floor or a headless machine with an antenna that keeps dropping.

The tree is C, and the file names describe a screen-oriented program rather than a library. info_scr.c, scan_scr.c, lhist_scr.c, conf_scr.c and help_scr.c sit alongside ui.c, while the radio access is kept in iw_nl80211.c, iw_scan.c and iw_if.c. A linked list helper lives in llist.c and the failure path in error.c, so the drawing code and the netlink code are separable layers. The project is not archived, and the last push was on 2026-06-29, so the tree you compile is close to what upstream is shipping.

Netlink and libnl sit between the radio and the display

wavemon does not invent its own wireless protocol. It reads the kernel through the netlink interface using libnl, and the source names make that division plain: iw_nl80211.c and iw_nl80211.h wrap the nl80211 family, iw_scan.c handles scan requests, and iw_if.c answers interface level queries. The header at the top of the tree, nl80211.h, is not original work. It is third-party code taken from the iw utility, which matters for licensing later on.

The dependency list is explicit that netlink libnl-cli-3-dev at least version 3.2 is required, and that it pulls in libnl-3-dev and libnl-genl-3-dev alongside the ncurses development files. rfkill.c sits at the same level as the interface code, so soft radio blocking is part of the state the program can report rather than something bolted on from the outside. Configuration is handled in conf.c and presented through conf_scr.c, and the tree ships wavemonrc.5, the manual page for the configuration file, so a wavemonrc file is a normal part of an installed system.

Building the tree with autoconf

wavemon reaches users in two forms. The project points first at distribution packages, with apt-cache search wavemon for Debian and Ubuntu, and separately at slackbuild scripts for Slackware. When you want the current source instead, the build is a standard autoconf project, and configure sits next to configure.ac, aclocal.m4, Makefile.in and a config directory, so a release tarball needs no bootstrap step.

The short build is:

./configure && make && sudo make install

The project notes that make uninstall reverses the installation if you are not happy with the result. On Debian and Ubuntu the build dependencies come from the package manager:

apt-get -y install pkg-config libncursesw6 libtinfo6 libncurses-dev libnl-cli-3-dev

The w in libncursesw6 matters. The wide-character variant of ncurses is required for proper rendering on UTF-8 terminals, and the project links an issue that tracks that rendering problem.

Compiler flags go to configure rather than to make:

CFLAGS="-O2 -pipe" ./configure

Passing CFLAGS to make is discouraged because it replaces the settings configure already found. If you have edited the autoconf files, or you are working from a git checkout, run

./config/bootstrap

to regenerate the configure state, and that step requires a recent installation of autotools.

Scan privileges are settled at install time

Scanning is the operation that pushes wavemon up against Linux permission boundaries, and the project treats that as an install-time decision rather than a runtime prompt. Restricted networking operations are what a scan needs, so the tree offers a target that installs the binary with elevated rights:

sudo make install-suid-root

That target is the route to take when a normal account should be able to trigger scans without handing out a root shell. No separate group, capability or polkit mechanism appears anywhere in the documentation, so the suid path is the only privilege grant the project actually describes, and anyone with a stricter policy will have to look elsewhere.

The display follows the same split. scan_scr.c handles the scanning view, info_scr.c shows interface and link information, lhist_scr.c keeps a history of readings, and help_scr.c carries the key bindings. Because the whole interface is ncurses rather than a window system, the program runs over SSH on a machine with no display server, which is a frequent reason to reach for it in the first place.

Device support varies, and monitor mode is not claimed

Several limits are visible without running anything. Coverage of hardware is hedged: the project states that wavemon should work with all devices supported by the Linux kernel, but with varying features, so the same interface can expose different sets of counters on different chipsets. There is no capture and no injection in this tree. The numbers on screen are the ones the kernel already maintains per interface, and that is a narrower dataset than a monitoring tool might suggest.

Hardware support is also not the same thing as monitor mode, and the project never claims monitor mode, so anyone planning to use wavemon as a capture tool should check the kernel driver path for their adapter rather than assume the screen will light up. The same gap shows in the documentation. The README directs you to the man page for an in-depth description of operation and configuration, and the tree ships wavemon.1 and wavemonrc.5, but the project itself stays short on what individual options do, on how to script the output, and on how to reverse a configuration change.

The release history points the same way. v0.9.5 in October 2023 added support for XDG_CONFIG_HOME and white backgrounds, v0.9.6 in July 2024 brought non-blocking netlink, and v0.9.7 landed on 2026-02-08.

Two ways in: the package or the current tree

The packaged route and the source route differ in a way that matters for anyone deploying this across a fleet. A distribution package arrives with a netlink library and a curses library chosen by the distribution maintainer, so the version floor of libnl-cli-3-dev 3.2 and the wide-character ncurses requirement are already reconciled against that release. The build from the tree hands you the upstream code exactly, at the cost of a toolchain on every target machine and a configure run per architecture.

The practical difference shows up in the netlink layer. The non-blocking netlink change that shipped in v0.9.6 affects how the program talks to the kernel, and a packaged build will only carry that work if the distribution has moved past the older release. Distributions also tend to lag a tag by however long their release cycle takes, and v0.9.7 from February 2026 is recent enough that older LTS archives may still be serving v0.9.5. The packaged path also skips the suid-root question entirely, since a maintainer has already decided how the binary is installed and which permissions it carries, while a source install leaves that decision to you.

The licence is split across two files

wavemon is released under the GNU General Public License v3.0 or later, with the SPDX-License-Identifier GPL-3.0-or-later carried in the source files and the full text in the LICENSE file. The wrinkle is nl80211.h, which is code taken from the iw utility and stays under the ISC License in a separate LICENSE.iw file. That is the part of the tree to read before redistributing, because the two sets of obligations do not live in the same document, and the mix of a permissive third-party header inside a GPL project is the kind of detail a compliance reviewer will ask about.

Upgrade cost is modest on the build side. Since the project is autoconf based, a rebuild after a kernel headers update means rerunning configure and make, and a source tree from git needs the extra bootstrap step. Maintenance is slower than the release count suggests: three tagged versions between late 2023 and early 2026, with the last push on 2026-06-29, so the code moves in bursts rather than on a schedule.

Editorial conclusion

wavemon suits administrators and engineers who want continuous visibility into a wireless link on a headless Linux box, and it is a poor fit for anyone who needs packet capture, monitor mode, or scripting of the output. Before adopting it, check the suid-root target and your distribution's netlink package version, then confirm the driver path for your adapter exposes the counters you expect, because feature coverage varies from one kernel-supported device to the next.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. uoaerg/wavemon on GitHub