Sniffing with Airodump-ng
With our wireless interface in monitor mode,
we initiate our first sniffing session with Airodump-ng.
We'll add the -c shorthand channel option to only capture traffic on channel 2,
and specify our wireless interface.
Once we execute the command, our packet capture begins.
Airodump-ng Fields
Airodump-ng presents a great deal of information while it is capturing.
We can press the space bar to pause the output.
The output is separated into two separate sections.
The top portion provides information about detected APs
along with the encryption in use, network names, etc.
The lower portion provides information about stations sending frames
and the associated AP.
The top line of the display, beginning at the left, shows the current channel,
followed by the elapsed sniffing time,
and, the current date and time,
it also indicates that a WPA handshake was captured for the AP.
The ultimate goal of this utility is to Capture a WPA handshake
The BSSID is the MAC address of the AP.
Power indicates the signal level reported by the card,
which will get higher as we get closer to the AP or station.
Receive Quality is measured by the percentage of frames successfully received
over the last 10 seconds.
Beacons is the number of beacons sent by the AP.
Data indicates the number of captured data packets
(if WEP, this is the unique IV count), including data broadcast packets.
The number sign indicates the number of data packets per second
measured over the last 10 seconds.
The Channel number is taken from beacon frames.
In some cases frames from one channel may be captured on another channel
due to channel overlap.
MB is the maximum speed supported by the AP.
ENC indicates the encryption algorithm in use
OPN, if shown, means there is no encryption.
In this case the detected security protocol is CIPHER.
AUTH indicates the detected authentication protocol.
The ESSID indicates the wireless network name.
When an ESSID is hidden,
the display can be length and a number corresponding the to number of characters.
Alternatively the ESSID may display zero length
indicating that the AP is configured to hide the number of characeters.
In the lower station output, Airodump-ng presents a list of devices.
Unless specified in the options,
any station sending frames is listed in the STATION column.
If the stations are connected to an AP, the BSSID is displayed.
If not, the field will show not associated.
The Rate indicates the last used rates between the client the AP.
The first number indicates the rate of data from AP to the client,
and the second indicates the rate of data from the client to the AP.
Note that the Rate column will only be displayed
when we are locked onto a single channel.
It won’t be visible when channel hopping.
The Lost field measures lost frames originating from the client station.
To determine the number of frames lost,
Airodump-ng measures the sequence field of every non-control frame.
There are a number of possible reasons for lost frames.
Refer to your lab guide for more information about this.
The Frames field indicates the number of data frames sent by the client.
The Notes field will indicate if the particular client has done a handshake,
or if it sees PMKID.
This is because the “WPA Handshake” message on the top line
doesn’t indicate which client performed the handshake.
The Probes field indicates the ESSIDs probed by the client.