How to put Mac OS X wireless adapter in monitor mode
I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.
From man iwconfig mode Monitor does the following:
"the node is not associated with any cell and passively monitor all packets on the frequency"
networking osx wifi
add a comment |
I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.
From man iwconfig mode Monitor does the following:
"the node is not associated with any cell and passively monitor all packets on the frequency"
networking osx wifi
add a comment |
I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.
From man iwconfig mode Monitor does the following:
"the node is not associated with any cell and passively monitor all packets on the frequency"
networking osx wifi
I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.
From man iwconfig mode Monitor does the following:
"the node is not associated with any cell and passively monitor all packets on the frequency"
networking osx wifi
networking osx wifi
asked Sep 20 '12 at 8:08
Hugo
190128
190128
add a comment |
add a comment |
5 Answers
5
active
oldest
votes
What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport
. It's a binary command, which I've symlinked into /usr/local/bin/
for convenience.
Creating Symlink:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
Example of sniffing in monitor mode:
sudo airport en1 sniff 1
This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap
(where XXXXXX will vary). You can view this with tcpdump -r <filename>
or by opening it in wireshark
.
To search for active channels nearby that you can sniff, run this:
sudo airport en1 -s
Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.
It Works. Just a side note, the capture file extension is.cap
and not.pcap
as described. (OS X Mavericks 10.9)
– Vitim.us
Apr 21 '14 at 1:25
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
add a comment |
You can also do it via the GUI if that is easier for you.
In Mavericks:
- Search Spotlight (Command+Space) for "Wireless
Diagnostics" - When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
- Click on the Frame Capture Tab
- Rename the output .wcap file to .pcap for use with Eye P.A.
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
add a comment |
Pass the -I flag to tcpdump or tshark (wireshark command-line utility).
For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':
tcpdump -Ini en0 -w save.pcap
Or to examine probe request 802.11 management frames live:
tshark -Ini en0 -s 256 type mgt subtype probe-req
Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:
sudo chmod 0644 /dev/bpf*
add a comment |
by default on OSX en0 is your ethernet port, while en1 is your airport
try:
iwconfig en1 mode monitor
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
|
show 1 more comment
sudo tcpdump -Ii en0 > sniff
New contributor
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f48671%2fhow-to-put-mac-os-x-wireless-adapter-in-monitor-mode%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
5 Answers
5
active
oldest
votes
5 Answers
5
active
oldest
votes
active
oldest
votes
active
oldest
votes
What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport
. It's a binary command, which I've symlinked into /usr/local/bin/
for convenience.
Creating Symlink:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
Example of sniffing in monitor mode:
sudo airport en1 sniff 1
This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap
(where XXXXXX will vary). You can view this with tcpdump -r <filename>
or by opening it in wireshark
.
To search for active channels nearby that you can sniff, run this:
sudo airport en1 -s
Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.
It Works. Just a side note, the capture file extension is.cap
and not.pcap
as described. (OS X Mavericks 10.9)
– Vitim.us
Apr 21 '14 at 1:25
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
add a comment |
What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport
. It's a binary command, which I've symlinked into /usr/local/bin/
for convenience.
Creating Symlink:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
Example of sniffing in monitor mode:
sudo airport en1 sniff 1
This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap
(where XXXXXX will vary). You can view this with tcpdump -r <filename>
or by opening it in wireshark
.
To search for active channels nearby that you can sniff, run this:
sudo airport en1 -s
Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.
It Works. Just a side note, the capture file extension is.cap
and not.pcap
as described. (OS X Mavericks 10.9)
– Vitim.us
Apr 21 '14 at 1:25
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
add a comment |
What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport
. It's a binary command, which I've symlinked into /usr/local/bin/
for convenience.
Creating Symlink:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
Example of sniffing in monitor mode:
sudo airport en1 sniff 1
This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap
(where XXXXXX will vary). You can view this with tcpdump -r <filename>
or by opening it in wireshark
.
To search for active channels nearby that you can sniff, run this:
sudo airport en1 -s
Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.
What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport
. It's a binary command, which I've symlinked into /usr/local/bin/
for convenience.
Creating Symlink:
sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport
Example of sniffing in monitor mode:
sudo airport en1 sniff 1
This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap
(where XXXXXX will vary). You can view this with tcpdump -r <filename>
or by opening it in wireshark
.
To search for active channels nearby that you can sniff, run this:
sudo airport en1 -s
Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.
edited Apr 21 '14 at 1:22
Vitim.us
1034
1034
answered Sep 27 '12 at 19:52
bahamat
24.1k14690
24.1k14690
It Works. Just a side note, the capture file extension is.cap
and not.pcap
as described. (OS X Mavericks 10.9)
– Vitim.us
Apr 21 '14 at 1:25
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
add a comment |
It Works. Just a side note, the capture file extension is.cap
and not.pcap
as described. (OS X Mavericks 10.9)
– Vitim.us
Apr 21 '14 at 1:25
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
It Works. Just a side note, the capture file extension is
.cap
and not .pcap
as described. (OS X Mavericks 10.9)– Vitim.us
Apr 21 '14 at 1:25
It Works. Just a side note, the capture file extension is
.cap
and not .pcap
as described. (OS X Mavericks 10.9)– Vitim.us
Apr 21 '14 at 1:25
1
1
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
this works in yosemite as well
– jeremyforan
Oct 7 '14 at 14:13
add a comment |
You can also do it via the GUI if that is easier for you.
In Mavericks:
- Search Spotlight (Command+Space) for "Wireless
Diagnostics" - When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
- Click on the Frame Capture Tab
- Rename the output .wcap file to .pcap for use with Eye P.A.
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
add a comment |
You can also do it via the GUI if that is easier for you.
In Mavericks:
- Search Spotlight (Command+Space) for "Wireless
Diagnostics" - When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
- Click on the Frame Capture Tab
- Rename the output .wcap file to .pcap for use with Eye P.A.
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
add a comment |
You can also do it via the GUI if that is easier for you.
In Mavericks:
- Search Spotlight (Command+Space) for "Wireless
Diagnostics" - When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
- Click on the Frame Capture Tab
- Rename the output .wcap file to .pcap for use with Eye P.A.
You can also do it via the GUI if that is easier for you.
In Mavericks:
- Search Spotlight (Command+Space) for "Wireless
Diagnostics" - When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
- Click on the Frame Capture Tab
- Rename the output .wcap file to .pcap for use with Eye P.A.
answered Jun 7 '14 at 17:50
skywinder
21124
21124
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
add a comment |
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
Woah, Narnia! I didn't even know this existed!
– Matt
Oct 24 '14 at 5:38
add a comment |
Pass the -I flag to tcpdump or tshark (wireshark command-line utility).
For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':
tcpdump -Ini en0 -w save.pcap
Or to examine probe request 802.11 management frames live:
tshark -Ini en0 -s 256 type mgt subtype probe-req
Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:
sudo chmod 0644 /dev/bpf*
add a comment |
Pass the -I flag to tcpdump or tshark (wireshark command-line utility).
For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':
tcpdump -Ini en0 -w save.pcap
Or to examine probe request 802.11 management frames live:
tshark -Ini en0 -s 256 type mgt subtype probe-req
Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:
sudo chmod 0644 /dev/bpf*
add a comment |
Pass the -I flag to tcpdump or tshark (wireshark command-line utility).
For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':
tcpdump -Ini en0 -w save.pcap
Or to examine probe request 802.11 management frames live:
tshark -Ini en0 -s 256 type mgt subtype probe-req
Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:
sudo chmod 0644 /dev/bpf*
Pass the -I flag to tcpdump or tshark (wireshark command-line utility).
For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':
tcpdump -Ini en0 -w save.pcap
Or to examine probe request 802.11 management frames live:
tshark -Ini en0 -s 256 type mgt subtype probe-req
Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:
sudo chmod 0644 /dev/bpf*
answered Jun 7 '14 at 20:50
uwotm8
7113
7113
add a comment |
add a comment |
by default on OSX en0 is your ethernet port, while en1 is your airport
try:
iwconfig en1 mode monitor
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
|
show 1 more comment
by default on OSX en0 is your ethernet port, while en1 is your airport
try:
iwconfig en1 mode monitor
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
|
show 1 more comment
by default on OSX en0 is your ethernet port, while en1 is your airport
try:
iwconfig en1 mode monitor
by default on OSX en0 is your ethernet port, while en1 is your airport
try:
iwconfig en1 mode monitor
edited Sep 27 '12 at 19:31
bahamat
24.1k14690
24.1k14690
answered Sep 27 '12 at 19:04
h3rrmiller
9,06742238
9,06742238
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
|
show 1 more comment
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
2
2
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
There's no such command on Mac OS X.
– bahamat
Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that
– h3rrmiller
Sep 27 '12 at 19:36
1
1
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
You must have obtained it from somewhere else, it's not part of Mac OS X.
– bahamat
Sep 27 '12 at 19:54
1
1
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2.
– user44841
Feb 28 '15 at 10:01
3
3
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program?
– user44841
Feb 28 '15 at 10:02
|
show 1 more comment
sudo tcpdump -Ii en0 > sniff
New contributor
add a comment |
sudo tcpdump -Ii en0 > sniff
New contributor
add a comment |
sudo tcpdump -Ii en0 > sniff
New contributor
sudo tcpdump -Ii en0 > sniff
New contributor
New contributor
answered 17 mins ago
mithunpaul
1011
1011
New contributor
New contributor
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f48671%2fhow-to-put-mac-os-x-wireless-adapter-in-monitor-mode%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown