airodump-ng
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
airodump-ng [2014/11/05 04:27] – Airodump-ng: Updated help screen mister_x | airodump-ng [2022/05/01 21:03] (current) – [What's the meaning of the fields displayed by airodump-ng ?] PWR: Updated some wording mister_x | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Airodump-ng ====== | ====== Airodump-ng ====== | ||
===== Description ===== | ===== Description ===== | ||
- | Airodump-ng is used for packet capturing | + | Airodump-ng is used for packet |
- | Additionally, | + | Additionally, |
===== Usage ===== | ===== Usage ===== | ||
Line 15: | Line 15: | ||
--gpsd | --gpsd | ||
--write | --write | ||
- | -w : same as --write | + | -w : same as --write |
--beacons | --beacons | ||
--update | --update | ||
Line 25: | Line 25: | ||
are received (Default: 120 seconds) | are received (Default: 120 seconds) | ||
-r < | -r < | ||
+ | -T : While reading packets from a file, | ||
+ | simulate the arrival rate of them | ||
+ | as if they were " | ||
-x < | -x < | ||
+ | --manufacturer | ||
+ | --uptime | ||
+ | --wps : Display WPS information (if any) | ||
--output-format | --output-format | ||
< | < | ||
- | pcap, ivs, csv, gps, kismet, netxml | + | pcap, ivs, csv, gps, kismet, netxml, |
- | Short format " | + | |
- | The option can be specified multiple times. | + | |
- | specified will be output. | + | |
--ignore-negative-one : Removes the message that says | --ignore-negative-one : Removes the message that says | ||
fixed channel < | fixed channel < | ||
+ | --write-interval | ||
+ | < | ||
+ | --background < | ||
+ | -n <int> : Minimum AP packets recv'd before | ||
+ | for displaying it | ||
Filter options: | Filter options: | ||
Line 46: | Line 54: | ||
By default, airodump-ng hop on 2.4GHz channels. | By default, airodump-ng hop on 2.4GHz channels. | ||
You can make it capture on other/ | You can make it capture on other/ | ||
+ | --ht20 | ||
+ | --ht40- | ||
+ | --ht40+ | ||
--channel < | --channel < | ||
--band < | --band < | ||
Line 75: | Line 86: | ||
| | ||
| | ||
- | | + | |
| | ||
| | ||
- | (not associated) | + | (not associated) |
| | ||
- | | + | |
The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. | The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. | ||
Line 93: | Line 104: | ||
^Field^Description^ | ^Field^Description^ | ||
|BSSID|MAC address of the access point. In the Client section, a BSSID of "(not associated)" | |BSSID|MAC address of the access point. In the Client section, a BSSID of "(not associated)" | ||
- | |PWR|Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher | + | |PWR|Signal level reported by the Wi-Fi adapter. Its signification depends on the driver, but as you get closer to the AP or the station, the signal gets higher. It usually is the [[https:// |
|RXQ|Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. | |RXQ|Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. | ||
|Beacons|Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.| | |Beacons|Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.| | ||
|# Data|Number of captured data packets (if WEP, unique IV count), including data broadcast packets.| | |# Data|Number of captured data packets (if WEP, unique IV count), including data broadcast packets.| | ||
|#/s|Number of data packets per second measure over the last 10 seconds.| | |#/s|Number of data packets per second measure over the last 10 seconds.| | ||
- | |CH|Channel number (taken from beacon packets).\\ Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.| | + | |CH|Channel number (taken from beacon packets).\\ Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference |
- | |MB|Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. | + | |MB|Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and up to 54 are 802.11g. Anything higher is 802.11n or 802.11ac. The dot (after 54 above) indicates short preamble is supported. |
- | |ENC|Encryption algorithm in use. OPN = no encryption," | + | |ENC|Encryption algorithm in use. OPN = no encryption," |
|CIPHER|The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. | |CIPHER|The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. | ||
|AUTH|The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).| | |AUTH|The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).| | ||
|ESSID|Shows the wireless network name. The so-called " | |ESSID|Shows the wireless network name. The so-called " | ||
|STATION|MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)" | |STATION|MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)" | ||
+ | |Rate| Station' | ||
|Lost|The number of data packets lost over the last 10 seconds based on the sequence number. | |Lost|The number of data packets lost over the last 10 seconds based on the sequence number. | ||
|Packets|The number of data packets sent by the client.| | |Packets|The number of data packets sent by the client.| | ||
+ | |Notes|Additional information about the client, such as captured EAPOL or PMKID.| | ||
|Probes|The ESSIDs probed by the client. | |Probes|The ESSIDs probed by the client. | ||
Line 275: | Line 288: | ||
* You run airmon-ng to set the channel while airodump-ng is running. | * You run airmon-ng to set the channel while airodump-ng is running. | ||
* You run another instance of airodump-ng in scanning mode or set to another channel. | * You run another instance of airodump-ng in scanning mode or set to another channel. | ||
- | * There is a known bug that affects recent versions of compat-wireless or wireless-testing drivers (shows channel as -1): http:// | ||
\\ | \\ | ||
\\ | \\ |
airodump-ng.txt · Last modified: 2022/05/01 21:03 by mister_x