airodump-ng
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
airodump-ng [2019/08/17 22:51] – [What's the meaning of the fields displayed by airodump-ng ?] Added missing rate column mister_x | airodump-ng [2022/05/01 20:57] – [What's the meaning of the fields displayed by airodump-ng ?] Improved PWR a bit more mister_x | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Airodump-ng ====== | ====== Airodump-ng ====== | ||
===== Description ===== | ===== Description ===== | ||
- | Airodump-ng is used for packet capturing | + | Airodump-ng is used for packet |
- | Additionally, | + | Additionally, |
===== Usage ===== | ===== Usage ===== | ||
Line 15: | Line 15: | ||
--gpsd | --gpsd | ||
--write | --write | ||
- | -w : same as --write | + | -w : same as --write |
--beacons | --beacons | ||
--update | --update | ||
Line 25: | Line 25: | ||
are received (Default: 120 seconds) | are received (Default: 120 seconds) | ||
-r < | -r < | ||
+ | -T : While reading packets from a file, | ||
+ | simulate the arrival rate of them | ||
+ | as if they were " | ||
-x < | -x < | ||
--manufacturer | --manufacturer | ||
Line 32: | Line 35: | ||
< | < | ||
pcap, ivs, csv, gps, kismet, netxml, logcsv | pcap, ivs, csv, gps, kismet, netxml, logcsv | ||
- | Short format " | ||
- | The option can be specified multiple times. | ||
- | specified will be output. | ||
--ignore-negative-one : Removes the message that says | --ignore-negative-one : Removes the message that says | ||
fixed channel < | fixed channel < | ||
--write-interval | --write-interval | ||
< | < | ||
+ | --background < | ||
+ | -n <int> : Minimum AP packets recv'd before | ||
+ | for displaying it | ||
Filter options: | Filter options: | ||
Line 83: | Line 86: | ||
| | ||
| | ||
- | | + | |
| | ||
| | ||
- | (not associated) | + | (not associated) |
| | ||
- | | + | |
The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. | The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. | ||
Line 101: | Line 104: | ||
^Field^Description^ | ^Field^Description^ | ||
|BSSID|MAC address of the access point. In the Client section, a BSSID of "(not associated)" | |BSSID|MAC address of the access point. In the Client section, a BSSID of "(not associated)" | ||
- | |PWR|Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn' | + | |PWR|Signal level reported by the Wi-Fi adapter. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. It usually is the [[https:// |
|RXQ|Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. | |RXQ|Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. | ||
|Beacons|Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.| | |Beacons|Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.| | ||
|# Data|Number of captured data packets (if WEP, unique IV count), including data broadcast packets.| | |# Data|Number of captured data packets (if WEP, unique IV count), including data broadcast packets.| | ||
|#/s|Number of data packets per second measure over the last 10 seconds.| | |#/s|Number of data packets per second measure over the last 10 seconds.| | ||
- | |CH|Channel number (taken from beacon packets).\\ Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.| | + | |CH|Channel number (taken from beacon packets).\\ Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference |
- | |MB|Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. | + | |MB|Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and up to 54 are 802.11g. Anything higher is 802.11n or 802.11ac. The dot (after 54 above) indicates short preamble is supported. |
- | |ENC|Encryption algorithm in use. OPN = no encryption," | + | |ENC|Encryption algorithm in use. OPN = no encryption," |
|CIPHER|The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. | |CIPHER|The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. | ||
|AUTH|The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).| | |AUTH|The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).| | ||
Line 116: | Line 119: | ||
|Lost|The number of data packets lost over the last 10 seconds based on the sequence number. | |Lost|The number of data packets lost over the last 10 seconds based on the sequence number. | ||
|Packets|The number of data packets sent by the client.| | |Packets|The number of data packets sent by the client.| | ||
+ | |Notes|Additional information about the client, such as captured EAPOL or PMKID.| | ||
|Probes|The ESSIDs probed by the client. | |Probes|The ESSIDs probed by the client. | ||
airodump-ng.txt · Last modified: 2022/05/01 21:03 by mister_x