Tcpdump/Wireless/Mac - Revision history

Admin: /* Channel-Hopping on Mac */

2016-01-27T05:32:34Z

Channel-Hopping on Mac

← Older revision		Revision as of 05:32, 27 January 2016
Line 28:		Line 28:

	When you run tcpdump with the <code>-I</code> flag, it will put the card in monitor mode and automatically cycle through all the channels. This will significantly boost the amount of traffic you dump to your pcap file!		When you run tcpdump with the <code>-I</code> flag, it will put the card in monitor mode and automatically cycle through all the channels. This will significantly boost the amount of traffic you dump to your pcap file!

			===Listening to Specific Channel on Mac===

	Note that you can also use airport to monitor a single channel, e.g., channel 7:		Note that you can also use airport to monitor a single channel, e.g., channel 7:
Line 34:		Line 36:
	sudo airport en1 sniff 7		sudo airport en1 sniff 7
	</pre>		</pre>




	{{TcpdumpFlag}}		{{TcpdumpFlag}}

Admin at 01:58, 24 January 2016

2016-01-24T01:58:18Z

← Older revision		Revision as of 01:58, 24 January 2016
Line 35:		Line 35:
	</pre>		</pre>

	~~[[Category:Tcpdump]]~~		{{TcpdumpFlag}}
	~~[[Category:Networking]]~~

Admin: Created page with "===Monitor Mode in Mac=== To put the wireless card into monitor mode, you can use the capital I flag `-I` with tcpdump. Alternatively, you can use the `air..."`


2016-01-23T21:17:07Z
Created page with "===Monitor Mode in Mac===  To put the wireless card into monitor mode, you can use the capital I flag <code>-I</code> with tcpdump.    Alternatively, you can use the <code>air..."
New page
===Monitor Mode in Mac===



To put the wireless card into monitor mode, you can use the capital I flag <code>-I</code> with tcpdump. 





Alternatively, you can use the <code>airport</code> utility, located at:



<pre>

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport.

</pre>



conveniently symlinked to <code>/usr/local/bin</code>:



<pre>

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport

</pre>





You can also use the <code>-n</code> flag to make things more readable.



<pre>

sudo tcpdump -In -i en1 -w save.pcap

</pre>



More information over at [http://unix.stackexchange.com/questions/48671/how-to-put-mac-os-x-wireless-adapter-in-monitor-mode Unix Stack Exhange].



===Channel-Hopping on Mac===



When you run tcpdump with the <code>-I</code> flag, it will put the card in monitor mode and automatically cycle through all the channels. This will significantly boost the amount of traffic you dump to your pcap file!



Note that you can also use airport to monitor a single channel, e.g., channel 7:



<pre>

sudo airport en1 sniff 7

</pre>



[[Category:Tcpdump]]

[[Category:Networking]]

Tcpdump/Wireless/Mac - Revision history

Admin: /* Channel-Hopping on Mac */

Admin at 01:58, 24 January 2016

Admin: Created page with "===Monitor Mode in Mac=== To put the wireless card into monitor mode, you can use the capital I flag -I with tcpdump. Alternatively, you can use the air..."

Admin: Created page with "===Monitor Mode in Mac=== To put the wireless card into monitor mode, you can use the capital I flag `-I` with tcpdump. Alternatively, you can use the `air..."`