Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any equivalent of airodump-ng for Mac OS X (it only runs on linux), providing an overview of the current wireless traffic on nearby Access Points, i.e:

  • number of captured data packets
  • list of devices currently associated with each AP
share|improve this question

10 Answers 10

You can install it using brew

brew install aircrack-ng

Or using port

sudo port install aircrack-ng

share|improve this answer
12  
aircrack-ng suite can actually be installed but the airodump-ng tool won't work on Mac OS (cf wirelessdefence.org/Contents/AircrackORIGINAL.html#q0C0) – fiddler Apr 5 '14 at 16:03

As I don't have a running linix box at present I'm not up on the capabilities of aircrack-ng

Possibles: iStumbler at http:istumbler.net Of the fairly sparse field,this one is probably the most current.

KisMac is a older port of Kismet last released in 2006, but reported to work on Snow Leopard. Haven't tried it.

Another possible useful tool is WireShark. You will need to install XQuartz to use it, as it's an X11 windows app.

A final possibility is to install windows under VirtualBox, Parallels or VMFusion and give it full access to your ethernet cards.


Based on the clarification in your comment, I think wireshark would do what you want if you want to look at traffic.

If you just want to count packets, you can use netstat. This is a terminal program. (see man netstat)

~/Webwork/sftf
647 ==> netstat  -w10
            input        (Total)           output
   packets  errs      bytes    packets  errs      bytes colls
        73     0      17551         77     0      11256     0
        31     0       4731         41     0       6891     0

-w10 gives you a record every 10 seconds. If you wanted hourly records you'd use -w3600.

Netstat is general purpose. If you have multiple interfaces, you can filter to a given one with the -I flag. You can also do some filtering by protocol, address family.

If you need serious filtering (I want to know how many packets bitorrent sent to the pirate bay last week) then you need either wireshark or tcpdump. (Tcpdump is commandline) Wireshark is basically a GUI on top of tcpdump. Both have their place.

share|improve this answer
    
Thanks for mentioning iStumbler, it looks very interesting. But what I actually want is to gather information on the current traffic (number of data packets and list of associated clients). Virtualization is indeed a solution, but I wanted to know if there was a native Mac OS tool for that. – fiddler Jan 24 '14 at 8:26
    
I think netstat counting will only work once associated to a network, but not in monitor mode, am I wrong ? – fiddler Jan 26 '14 at 9:36
    
I just tried. [ netstat -I en2 -w 5 ] reports a string of zeros every 5 seconds. ( I have 4 interfaces on this computer. Overkill....) – Sherwood Botsford Jan 26 '14 at 20:21
up vote 1 down vote accepted

There doesn't seem to be any tool like this for Mac OS X, though it'd probably be possible to build a script that uses tools like airport and tshark to have an equivalent result.

share|improve this answer

You can easily install using homebrew

Do brew install aircrack-ng

Then do

airodump-ng-oui-update to install or update airodump-ng

share|improve this answer
    
aircrack-ng suite can actually be installed but the airodump-ng tool won't work on Mac OS – fiddler Aug 11 '15 at 12:52

I am using aircrack-ng on my mac, from the terminal, not emulating another OS. Here is a good page mentioning the relation to other tools, which I think may help you : http://easymactips.blogspot.com/2010/10/how-to-install-aircrack-on-mac.html

By the way, maybe you already have in the system what you are looking for: hidden in your airport is, from yosemite on, a sniffer. Press option and your wifi icon, you will see the option wireless diagnostics. Command 4 is scan (you see networks, channels, MACs, and other data) and command 6 is sniffer. Give that a try too. Best greetings.

share|improve this answer

You might want to try KisMac2 : https://github.com/IGRSoft/KisMac2

share|improve this answer
    
I'm rather looking for a command line tool, not a GUI. – fiddler Aug 11 '15 at 14:15

Have you tried http://www.aircrack-ng.org/doku.php?id=install_aircrack

It has instructions to install aircrack-ng on Mac.
From the website:

Installing on Mac OSX The simplest and easiest way to install on Mac OS X is via Macports. You simply do “sudo >port install aircrack-ng”.

Alternatively, use the following instructions:

Make sure you have Xcode installed on your Mac, which can be found on the installer >CD/DVD which came with your Mac. After getting the source you can do a simple “make && >sudo make install” from the untarred directory. When you use the stable, you need to >rename the Makefile.osx to Makefile and when you use the dev version it will autodetect you are using Darwin and compile fine.

Mind you, airodump-ng and aireplay-ng are linux only and will not work under OSX native, so for reinjecting and sniffing you will have to use other means.

If you have an intel Mac check out the VMware Fusion option which is mentioned lower on >this page.

Optional is openssl-dev and sqlite3 which can be installed through fink

share|improve this answer
6  
Well, as said in your quote, airodump-ng and aireplay-ng are linux only and will not work under OSX native. And it indeed does not work. That's why I'm looking for an alternative on Mac OS X (not for packet injection, just for dumping APs and clients along with the number of data packets for each AP) – fiddler Jan 23 '14 at 6:13

It is possible to use Wireshark with monitor mode enabled to essentially do the job of airodump-ng. This will allow for capture of raw 802.11 frames which will show the traffic from APs and clients. It needs to be remembered that the WiFi device can only listen on one channel at a time so you'll only see the traffic on the channel it's set to. You can choose the channel by associating a desired network before the capture or using the using the airport (/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport) command (e.g. to sniff channel 1 given your WiFi adapter is called en1) :

airport en1 sniff 1

Note that command this will also capture packets to file so one can just use airport to capture and then open the file in Wireshark or just quit the airport command after you have started monitor mode capture and let Wireshark collect them so you can see them in realtime. One can actually change the capture channel whilst Wireshark is running but you may miss packets whilst the channel change occurs.

share|improve this answer

After much frustration with this same problem I found a way to actually use Airodump on my Mac terminal. What I realized is that all of the files that I can successfully execute are located in the directory path

/usr/local/bin/

And it turns out that Airodump was actually on my computer, it was just stored in the path

/usr/local/sbin

And I was unable to execute it from that path. All I did was move Airodump from the /usr/local/sbin path to the /usr/local/bin path and it now works great! I was going crazy for hours and it was that simple

share|improve this answer

Since aircrac-ng lacks both airodump-ng and aireplay-ng[ref. their documentation] you should look into: KisMac2. An open source wireless stumbling and security tool for Mac OS X.

Among other things it:

  • Shows logged in clients
  • Can capture packets (PCAP export possible)
  • Reveals hidden SSIDs
  • Can perform various attacks like the "deauthentication attack"

They link the zipped .dmg file at the end of the README file: KisMac2.zip.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.