iw dev wlan0 interface add mon0 type monitor

$ sudo tcpdump -vei mon0 udp
tcpdump: WARNING: mon0: no IPv4 address assigned
tcpdump: listening on mon0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes
<time> <signal info> DA:Broadcast BSSID:... SA:... LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype IPv4 (0x0800): (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 53)
    10.0.0.1.1234 > 255.255.255.255.1234: UDP, length 17

$ ip link
...
7: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc mq state DOWN qlen 1000
    link/ether 00:21:6a:c5:3e:7a brd ff:ff:ff:ff:ff:ff
8: mon0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN qlen 1000
    link/ieee802.11/radiotap 00:21:6a:c5:3e:7a brd ff:ff:ff:ff:ff:ff

iw dev wlan0 set type monitor
ip link set wlan0 promisc on