Equivalent of airodump-ng for Max OS X

Question

Is there any equivalent of airodump-ng for Mac OS X (it only runs on linux), providing an overview of the current wireless traffic on nearby Access Points, i.e:

• number of captured data packets
• list of devices currently associated with each AP

Answer 1

You can install it using brew

brew install aircrack-ng

Or using port

sudo port install aircrack-ng

Answer 2

After much frustration with this same problem I found a way to actually use Airodump on my Mac terminal. What I realized is that all of the files that I can successfully execute are located in the directory path

/usr/local/bin/

And it turns out that Airodump was actually on my computer, it was just stored in the path

/usr/local/sbin

And I was unable to execute it from that path. All I did was move Airodump from the /usr/local/sbin path to the /usr/local/bin path and it now works great! I was going crazy for hours and it was that simple

Answer 3

It is possible to use Wireshark with monitor mode enabled to essentially do the job of airodump-ng. This will allow for capture of raw 802.11 frames which will show the traffic from APs and clients. It needs to be remembered that the WiFi device can only listen on one channel at a time so you'll only see the traffic on the channel it's set to. You can choose the channel by associating a desired network before the capture or using the using the airport (/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport) command (e.g. to sniff channel 1 given your WiFi adapter is called en0) :

airport en0 sniff 1

Note that command this will also capture packets to a file (it's name will be printed when the sniff command exits) so one can just use airport to capture and then open the file in Wireshark or just quit the airport command after you have started monitor mode capture and let Wireshark collect them so you can see them in realtime. One can actually change the capture channel whilst Wireshark is running but you may miss packets whilst the channel change occurs.

Answer 4

You can easily install using homebrew

Do brew install aircrack-ng

Then do

airodump-ng-oui-update to install or update airodump-ng

Answer 5

As I don't have a running linix box at present I'm not up on the capabilities of aircrack-ng

Possibles: iStumbler at http:istumbler.net Of the fairly sparse field,this one is probably the most current.

KisMac is a older port of Kismet last released in 2006, but reported to work on Snow Leopard. Haven't tried it.

Another possible useful tool is WireShark. You will need to install XQuartz to use it, as it's an X11 windows app.

A final possibility is to install windows under VirtualBox, Parallels or VMFusion and give it full access to your ethernet cards.

---

Based on the clarification in your comment, I think wireshark would do what you want if you want to look at traffic.

If you just want to count packets, you can use netstat. This is a terminal program. (see man netstat)

~/Webwork/sftf
647 ==> netstat  -w10
            input        (Total)           output
   packets  errs      bytes    packets  errs      bytes colls
        73     0      17551         77     0      11256     0
        31     0       4731         41     0       6891     0

-w10 gives you a record every 10 seconds. If you wanted hourly records you'd use -w3600.

Netstat is general purpose. If you have multiple interfaces, you can filter to a given one with the -I flag. You can also do some filtering by protocol, address family.

If you need serious filtering (I want to know how many packets bitorrent sent to the pirate bay last week) then you need either wireshark or tcpdump. (Tcpdump is commandline) Wireshark is basically a GUI on top of tcpdump. Both have their place.

Answer 6

I found out that pyrit can achieve a similar result:

1. Capture wireless traffic with tshark:

   sudo tshark -i en1 -I -w wlan.pcap
   

2. Analyze capture with pyrit:

   pyrit -r wlan.pcap analyze
   

Answer 7

I am using aircrack-ng on my mac, from the terminal, not emulating another OS. Here is a good page mentioning the relation to other tools, which I think may help you : http://easymactips.blogspot.com/2010/10/how-to-install-aircrack-on-mac.html

By the way, maybe you already have in the system what you are looking for: hidden in your airport is, from yosemite on, a sniffer. Press option and your wifi icon, you will see the option wireless diagnostics. Command 4 is scan (you see networks, channels, MACs, and other data) and command 6 is sniffer. Give that a try too. Best greetings.

Answer 8

Since aircrac-ng lacks both airodump-ng and aireplay-ng^{[ref. their documentation]} you should look into: KisMac2. An open source wireless stumbling and security tool for Mac OS X.

Among other things it:

• Shows logged in clients
• Can capture packets (PCAP export possible)
• Reveals hidden SSIDs
• Can perform various attacks like the "deauthentication attack"

They link the zipped .dmg file at the end of the README file: KisMac2.zip.

Answer 9

airodump-ng (as aireplay-ng, airbase-ng, airserve-ng, airtun-ng, …) is located in /usr/local/sbin on a Mac.

Therefore you can add this path to your $PATH env variable:

echo 'export PATH="/usr/local/sbin:$PATH"' >> ~/.profile

When running a new session (opening a new terminal or running source ~..profile) you have access to airodump-ng command and all other aircrack related.

Answer 10

You might want to try KisMac2 : https://github.com/IGRSoft/KisMac2

Answer 11

Have you tried http://www.aircrack-ng.org/doku.php?id=install_aircrack

It has instructions to install aircrack-ng on Mac.
From the website:

Installing on Mac OSX The simplest and easiest way to install on Mac OS X is via Macports. You simply do “sudo >port install aircrack-ng”.

Alternatively, use the following instructions:

Make sure you have Xcode installed on your Mac, which can be found on the installer >CD/DVD which came with your Mac. After getting the source you can do a simple “make && >sudo make install” from the untarred directory. When you use the stable, you need to >rename the Makefile.osx to Makefile and when you use the dev version it will autodetect you are using Darwin and compile fine.

Mind you, airodump-ng and aireplay-ng are linux only and will not work under OSX native, so for reinjecting and sniffing you will have to use other means.

If you have an intel Mac check out the VMware Fusion option which is mentioned lower on >this page.

Optional is openssl-dev and sqlite3 which can be installed through fink