airodump-ng (1) - Linux Man Pages
airodump-ng: a wireless packet capture tool for aircrack-ng
airodump-ng - a wireless packet capture tool for aircrack-ng
SYNOPSISairodump-ng [options] <interface name>
DESCRIPTIONairodump-ng is used for packet capturing of raw 802.11 frames for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points. Additionally, airodump-ng writes out a text file containing the details of all access points and clients seen.
- -H, --help
- Shows the help screen.
- -i, --ivs
- It only saves IVs (only useful for cracking). If this option is specified, you have to give a dump prefix (--write option)
- -g, --gpsd
- Indicate that airodump-ng should try to use GPSd to get coordinates.
- -w <prefix>, --write <prefix>
- Is the dump file prefix to use. If this option is not given, it will only show data on the screen. Beside this file a CSV file with the same filename as the capture will be created.
- -e, --beacons
- It will record all beacons into the cap file. By default it only records one beacon for each network.
- -u <secs>, --update <secs>
- Delay <secs> seconds delay between display updates (default: 1 second). Useful for slow CPU.
- Prints ACK/CTS/RTS statistics. Helps in debugging and general injection optimization. It is indication if you inject, inject too fast, reach the AP, the frames are valid encrypted frames. Allows to detect "hidden" stations, which are too far away to capture high bitrate frames, as ACK frames are sent at 1Mbps.
- Hides known stations for --showack.
- --berlin <secs>
- Time before removing the AP/client from the screen when no more packets are received (Default: 120 seconds). See airodump-ng source for the history behind this option ;).
- -c <channel>[,<channel>[,...]], --channel <channel>[,<channel>[,...]]
- Indicate the channel(s) to listen to. By default airodump-ng hop on all 2.4Ghz channels.
- -b <abg>, --band <abg>
- Indicate the band on which airodump-ng should hop. It can be a combination of 'a', 'b' and 'g' letters ('b' and 'g' uses 2.4Ghz and 'a' uses 5Ghz). Incompatible with --channel option.
- -s <method>, --cswitch <method>
- Defines the way airodump-ng sets the channels when using more than one card. Valid values: 0, 1 or 2.
- -r <file>
- Reads packet from a file.
- -x <msecs>
- Active Scanning Simulation (send probe requests and parse the probe responses).
- --output-format <formats>
Define the formats to use (separated by a comma). Possible values are: pcap, ivs, csv, gps, kismet, netxml. The default values are: pcap, csv, kismet, kismet-newcore.
Theses values can be combined with the exception of ivs and pcap.
- -t <OPN|WEP|WPA|WPA1|WPA2>, --encrypt <OPN|WEP|WPA|WPA1|WPA2>
- It will only show networks matching the given encryption. May be specified more than once: '-t OPN -t WPA2'
- -d <bssid>, --bssid <bssid>
- It will only show networks, matching the given bssid.
- -m <mask>, --netmask <mask>
- It will only show networks, matching the given bssid ^ netmask combination. Need --bssid (or -d) to be specified.
- It will only show associated clients.
EXAMPLESairodump-ng --band bg ath0
Here is an example screenshot:
CH 9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ BAT: 2 hours 10 mins ][ WPA handshake: 00:14:6C:7E:40:80
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:09:5B:1C:AA:1D 11 16 10 0 0 11 54. OPN <length: 7>
00:14:6C:7A:41:81 34 100 57 14 1 9 11 WEP WEP bigbear
00:14:6C:7E:40:80 32 100 752 73 2 9 54 WPA TKIP PSK teddy
BSSID STATION PWR Rate Lost Packets Probes
00:14:6C:7A:41:81 00:0F:B5:32:31:31 51 11-11 2 14 bigbear
(not associated) 00:14:A4:3F:8D:13 19 11-11 0 4 mossy
00:14:6C:7A:41:81 00:0C:41:52:D1:D1 -1 11-2 0 5 bigbear
00:14:6C:7E:40:80 00:0F:B5:FD:FB:C2 35 36-24 0 99 teddy
The first part is the detected access points. The second part is a list of detected wireless clients, stations. By relying on the signal power, one can even physically pinpoint the location of a given station.
AUTHORThis manual page was written by Adam Cecile <gandalf [at] le-vert.net> for the Debian system (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.