AIRODUMP-NG(8)

📦
version 1.7+git20230807.4bf83f1a · 3 versions
, in debian trixie, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🦋 airodump-ng — the manual page 🦋

bestie. sit down. we're reading airodump-ng(8) from the System Manager's Manual together and it's gonna be a whole vibe, but you're gonna leave knowing everything. no cap. 💅

✨ NAME ✨

airodump-ng — a wireless packet capture tool for aircrack-ng 🫶

🎀 SYNOPSIS 🎀

airodump-ng [options] <interface name>[,<interface name>,...]

like. yes. you can hand it more than one interface. comma-separated. she's flexible like that. ✨

💖 DESCRIPTION 💖

okay so airodump-ng is the girl who captures raw 802.11 frames, and the whole point of her is that you're gonna feed that capture to aircrack-ng later. that's the plot. 📦✨

and listen — if you've got a GPS receiver plugged into your computer, she can log the coordinates of every access point she finds. main character behavior fr fr. 🛰️💫

on top of all that, she also writes out a text file with the details of every single AP and client she's seen. so you get the screen and the receipts. 📝👑

🌈 OPTIONS 🌈

  • -H, --help — shows the help screen. the "hey bestie what do I do" button. 🆘
  • -i, --ivs — only saves IVs, and that's only useful for cracking. heads up though: if you turn this on, you have to give a dump prefix (the --write option). no prefix, no dice. 💀
  • -g, --gpsd — tells airodump-ng she should try to use GPSd to get coordinates. 🛰️
  • -w <prefix>, --write <prefix> — the dump file prefix you wanna use. if you don't pass this one, she'll only show data on the screen, nothing saved. and btw, right next to that file, a CSV file gets created with the same filename as the capture. two files, one vibe. 🗂️✨
  • -e, --beacons — records all the beacons into the cap file. by default she's chill and only records one beacon per network. 🐝
  • -u <secs>, --update <secs> — delays <secs> seconds between display updates (default: 1 second). super useful if your CPU is slow and struggling. give her a minute, she's trying. 😭
  • -A, --showack — prints ACK/CTS/RTS statistics. this is the debugging + injection-optimization girlie. it's an indication of whether you inject at all, inject too fast, actually reach the AP, and whether the frames are valid encrypted frames. it also lets you detect "hidden" stations that are too far away to capture high bitrate frames — because ACK frames are sent at 1Mbps. icon behavior honestly. 📡🔥
  • -h — hides known stations for --showack. (yeah, lowercase -h. not the help one. don't get it twisted bestie.) 🙈
  • -f <msecs> — the time in milliseconds between hopping channels. ⏱️
  • -B <secs>, --berlin <secs> — how long before she removes an AP/client from the screen when no more frames are coming in (Default: 120 seconds). and if you wanna know the history behind this option — go read the airodump-ng source ;). not me gatekeeping, the manpage said it. 💀
  • -c <channel>[,<channel>[,...]], --channel <channel>[,<channel>[,...]] — the channel(s) to listen to. by default she hops on all 2.4GHz channels. give her a list, she'll take it. 📻
  • -O, --ignore-other-chans — ignores access points on channels other than the one(s) you selected. requires --channel (or -c). no channel, no service. ✋
  • -C <freq>[,<freq>[,...]] — the frequencies to listen to. by default, again, she hops on all 2.4GHz channels. 📶
  • -b <abg>, --band <abg> — the band she should hop on. it can be a combo of the letters 'a', 'b' and 'g' — and for the record 'b' and 'g' use 2.4GHz while 'a' uses 5GHz. incompatible with the --channel option. pick a lane. 🛣️
  • -s <method>, --cswitch <method> — defines the way airodump-ng sets the channels when you're using more than one card. valid values: 0 (FIFO, default value), 1 (Round Robin) or 2 (Hop on last). 🃏
  • -2, --ht20 — sets the channel to be in HT20 (802.11n). ✌️
  • -3, --ht40+ — sets the channel to be in HT40+ (802.11n). it requires the frequency 20MHz above to be available (4 channels above), and because of that some channels are just not usable in HT40+. only channels up to 7 are available in HT40+ in the US (and 9 in most of Europe). plan accordingly bestie. 🗺️
  • -5, --ht40- — sets the channel to be in HT40- (802.11n). it requires the frequency 20MHz below to be available (4 channels below) and thus some channels are not usable in HT40-. in 2.4GHz, HT40- channels start at channel 5. 🖐️
  • -r <file> — reads packets from a file. 📂
  • -T, --real-time — while reading frames from a file you gave with '-r <file>', she simulates the arrival rate of them, as if they were "live". cinematic. 🎬
  • -x <msecs> — Active Scanning Simulation (sends probe requests and parses the probe responses). she's asking questions and she WILL get answers. 💬
  • -M, --manufacturer — displays a manufacturer column with the info pulled from the IEEE OUI list. see airodump-ng-oui-update(8). 🏭
  • -U, --uptime — displays APs uptime, obtained from its beacon timestamp. ⏳
  • -W, --wps — displays a WPS column with WPS version, config method(s), and AP Setup Locked — obtained from APs beacon or probe response (if any). 🔐
  • -o <formats>, --output-format <formats> — defines the formats to use, separated by a comma. possible values are: pcap, ivs, csv, gps, kismet, netxml. the default values are: pcap, csv, kismet, kismet-newcore. ok let's break it down: 'pcap' is for recording a capture in pcap format, 'ivs' is for ivs format (it's a shortcut for --ivs), 'csv' creates an airodump-ng CSV file, 'kismet' creates a kismet csv file, and 'kismet-newcore' creates the kismet netxml file. 'gps' is a shortcut for --gps. these values can be combined — with the exception of ivs and pcap. those two do NOT share the aux. 🚫
  • -I <seconds>, --write-interval <seconds> — output file(s) write interval for CSV, Kismet CSV and Kismet NetXML, in seconds (minimum: 1 second). by default: 5 seconds. note that an interval that's too small might slow down airodump-ng. don't rush her. 🐌
  • -K <enable>, --background <enable> — overrides automatic background detection. use "0" to force foreground settings and "1" to force background settings. and no, this will not make airodump-ng run as a daemon — it just skips background autodetection and forces enable/disable of interactive mode and display updates. read that again. 💅
  • --ignore-negative-one — removes the message that says 'fixed channel <interface>: -1'. bye girl 👋

🔍 Filter options 🔍

  • -t <OPN|WEP|WPA|WPA1|WPA2|WPA3|OWE>, --encrypt <OPN|WEP|WPA|WPA1|WPA2|WPA3|OWE> — only shows networks matching the given encryption. note that WPA is a shortcut for WPA1, WPA2 and WPA3. may be specified more than once: '-t OPN -t WPA2' 🎯
  • -d <bssid>, --bssid <bssid> — only shows networks matching the given bssid. may be specified more than once: '-d 0D:F7:E2:61:C6:6D -d 5B:62:A1:83:00:A8' 📍
  • -m <mask>, --netmask <mask> — only shows networks matching the given bssid ^ netmask combination. needs --bssid (or -d) to be specified. 🔗
  • -a — only shows associated stations. using it in combination with -z won't display any of the stations. 🫂
  • -z — only shows unassociated stations. using it in combination with -a won't display any of the stations. 🚶
  • -n <int>, --min-packets <int> — the minimum number of packets received by an AP before displaying it. default value: 2. 🔢
  • -p <int>, --min-power <int> — filters out APs with PWR less than the specified value (default value: -120). 📉
  • -q <int>, --min-rxq <int> — filters out APs with RXQ less than the specified value (default value: 0). valid range: 0..100. requires --channel (or -c) or -C. 📊
  • -N <essid>, --essid <essid> — filters APs by ESSID. may be specified more than once: '-N AP1 -N AP2' 🏷️
  • -R <regex>, --essid-regex <regex> — filters APs by ESSID using a regular expression. regex girlies rise 🙌

👑 INTERACTION 👑

airodump-ng can receive and interpret key strokes while she's running. here's the currently assigned keys and what they're supposed to do — learn them, they're free:

  • a — select active areas by cycling through these display options: AP+STA; AP+STA+ACK; AP only; STA only 🔄
  • d — reset sorting to defaults (Power) ↩️
  • i — invert the sorting algorithm 🔃
  • m — mark the selected AP, or cycle through different colors if the selected AP is already marked 🎨
  • o — enable colored display of APs and their stations 🌈
  • p — disable colored display ⚫
  • q — quit program. (the goodbye key 🥲)
  • r — (de-)activate realtime sorting — applies the sorting algorithm every time the display will be redrawn ♻️
  • s — change the column to sort by, which currently includes: First seen; BSSID; PWR level; Beacons; Data packets; Packet rate; Channel; Max. data rate; Encryption; Strongest Ciphersuite; Strongest Authentication; ESSID 📋
  • SPACE — pause display redrawing / resume redrawing ⏸️
  • TAB — enable/disable scrolling through the AP list 📜
  • UP — select the AP prior to the currently marked AP in the displayed list, if available ⬆️
  • DOWN — select the AP after the currently marked AP, if available ⬇️

and here's the cute part: if an AP is selected or marked, all the connected stations will also be selected or marked with the same color as the corresponding Access Point. matching. coordinated. iconic. 💖

✨ EXAMPLES ✨

okay bestie, let's see this icon in action. first, lock onto channel 9 on your monitor interface:

airodump-ng -c 9 wlan0mon

and here's the example screenshot, no cap:

       -----------------------------------------------------------------------
       CH  9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ BAT: 2 hours 10 mins ][
       WPA handshake: 00:14:6C:7E:40:80

       BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER
       AUTH ESSID

       00:09:5B:1C:AA:1D   11  16       10        0    0  11  54. OPN
       <length: 7>
       00:14:6C:7A:41:81   34 100       57       14    1   9  11  WEP  WEP
       bigbear
       00:14:6C:7E:40:80   32 100      752       73    2   9  54  WPA  TKIP
       PSK  teddy

       BSSID              STATION            PWR   Rate   Lost   Frames  Notes
       Probes

       00:14:6C:7A:41:81  00:0F:B5:32:31:31   51   11-11     2       14
       bigbear
       (not associated)   00:14:A4:3F:8D:13   19   11-11     0        4
       mossy
       00:14:6C:7A:41:81  00:0C:41:52:D1:D1   -1    11-2     0        5
       bigbear
       00:14:6C:7E:40:80  00:0F:B5:FD:FB:C2   35   36-24     0       99
       teddy
       -----------------------------------------------------------------------

now let's decode every single column like the tech bestie you are 💅

  • BSSID — the MAC address of the access point, bestie. In the Client section, a BSSID of "(not associated)" means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with. 🦋
  • PWR — signal level reported by the Wi-Fi adapter. Its meaning depends on the driver, but as you get closer to the AP or the station, the signal gets higher. It usually is the RSSI (https://en.wikipedia.org/wiki/Received_signal_strength_indication). If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If PWR is -1 for some access points, it means the access point is out of range, however airodump-ng got at least a frame sent to it. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your Wi-Fi adapter. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then it is likely that the driver doesn't support signal level reporting. A strong signal is around -40. An average one is around -55, and a weak one starts around -70. Wi-Fi adapters lower limit (aka receive sensitivity) is often around -80/-90. 😭
  • RXQ — only shown when on a fixed channel. Receive Quality as measured by the percentage of frames (management and data frames) successfully received over the last 10 seconds. It's measured over all management and data frames. That's the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP. 🔥
  • Beacons — number of beacons sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far. ✨
  • #Data — number of captured data packets (if WEP, unique IV count), including data broadcast packets. 💖
  • #/s — number of data packets per second measured over the last 10 seconds. 🎀
  • CH — channel number (taken from beacon frames). Note: sometimes frames from other channels are captured even if airodump-ng is not hopping, because of radio interference. 🌈
  • MB — maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. 'e' indicates that the network has QoS (802.11e) enabled. 👑
  • ENC — encryption algorithm in use. OPN = no encryption, "WEP?" = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP or MGT is present. 💀
  • CIPHER — the cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater than 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit. 🌸
  • AUTH — the authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP). 🫶
  • WPS — this is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the column indicates version supported. The second field indicates WPS config methods (can be more than one method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC = External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD = Keypad. Locked is displayed when AP setup is locked. 🔒
  • ESSID — the so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests. 🕵️‍♀️
  • STATION — MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)". 💅
  • Rate — this is only displayed when using a single channel. The first number is the last data rate from the AP (BSSID) to the Client (STATION). The second number is the last data rate from Client (STATION) to the AP (BSSID). 🏃‍♀️
  • Lost — it means lost frames coming from the client. To determine the number of frames lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many frames you have lost. 😵
  • Notes — additional information about the client, such as captured EAPOL or PMKID. 📝
  • Frames — the number of data packets sent by the client. 📦
  • Probes — the ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected. 🔍

so the first part of the screen is the detected access points. the second part is a list of detected wireless clients, stations. and by relying on the signal power, one can even physically pinpoint the location of a given station. main character energy fr fr. 💖

👑 AUTHOR 👑

this manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. on Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL. 🫶

🔥 SEE ALSO 🔥

this page is from airodump-ng version 1.7.0, dated May 2022, and the man page is AIRODUMP-NG(8) 💖✨

📦 where this page comes from