Is there any equivalent of airodump-ng for Mac OS X (it only runs on linux), providing an overview of the current wireless traffic on nearby Access Points, i.e:

  • number of captured data packets
  • list of devices currently associated with each AP

11 Answers 11


You can install it using brew

brew install aircrack-ng

Or using port

sudo port install aircrack-ng


After much frustration with this same problem I found a way to actually use Airodump on my Mac terminal. What I realized is that all of the files that I can successfully execute are located in the directory path


And it turns out that Airodump was actually on my computer, it was just stored in the path


And I was unable to execute it from that path. All I did was move Airodump from the /usr/local/sbin path to the /usr/local/bin path and it now works great! I was going crazy for hours and it was that simple

  • This isn't the right way to manage PATH on OS X and on any Unix. – dan Oct 19 '16 at 6:06
  • 2
    The right method is: PATH= ${PATH}:/usr/local/sbin and let the binaries where good installers put, find and update them. – dan Oct 19 '16 at 6:09
  • You've got an extra space after PATH= (had to remove it on my machine) – user1464581 Nov 28 '17 at 0:22

You can easily install using homebrew

Do brew install aircrack-ng

Then do

airodump-ng-oui-update to install or update airodump-ng

  • 2
    aircrack-ng suite can actually be installed but the airodump-ng tool won't work on Mac OS – sdabet Aug 11 '15 at 12:52

As I don't have a running linix box at present I'm not up on the capabilities of aircrack-ng

Possibles: iStumbler at http:istumbler.net Of the fairly sparse field,this one is probably the most current.

KisMac is a older port of Kismet last released in 2006, but reported to work on Snow Leopard. Haven't tried it.

Another possible useful tool is WireShark. You will need to install XQuartz to use it, as it's an X11 windows app.

A final possibility is to install windows under VirtualBox, Parallels or VMFusion and give it full access to your ethernet cards.

Based on the clarification in your comment, I think wireshark would do what you want if you want to look at traffic.

If you just want to count packets, you can use netstat. This is a terminal program. (see man netstat)

647 ==> netstat  -w10
            input        (Total)           output
   packets  errs      bytes    packets  errs      bytes colls
        73     0      17551         77     0      11256     0
        31     0       4731         41     0       6891     0

-w10 gives you a record every 10 seconds. If you wanted hourly records you'd use -w3600.

Netstat is general purpose. If you have multiple interfaces, you can filter to a given one with the -I flag. You can also do some filtering by protocol, address family.

If you need serious filtering (I want to know how many packets bitorrent sent to the pirate bay last week) then you need either wireshark or tcpdump. (Tcpdump is commandline) Wireshark is basically a GUI on top of tcpdump. Both have their place.

  • Thanks for mentioning iStumbler, it looks very interesting. But what I actually want is to gather information on the current traffic (number of data packets and list of associated clients). Virtualization is indeed a solution, but I wanted to know if there was a native Mac OS tool for that. – sdabet Jan 24 '14 at 8:26
  • I think netstat counting will only work once associated to a network, but not in monitor mode, am I wrong ? – sdabet Jan 26 '14 at 9:36
  • I just tried. [ netstat -I en2 -w 5 ] reports a string of zeros every 5 seconds. ( I have 4 interfaces on this computer. Overkill....) – Sherwood Botsford Jan 26 '14 at 20:21

It is possible to use Wireshark with monitor mode enabled to essentially do the job of airodump-ng. This will allow for capture of raw 802.11 frames which will show the traffic from APs and clients. It needs to be remembered that the WiFi device can only listen on one channel at a time so you'll only see the traffic on the channel it's set to. You can choose the channel by associating a desired network before the capture or using the using the airport (/System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport) command (e.g. to sniff channel 1 given your WiFi adapter is called en1) :

airport en1 sniff 1

Note that command this will also capture packets to file so one can just use airport to capture and then open the file in Wireshark or just quit the airport command after you have started monitor mode capture and let Wireshark collect them so you can see them in realtime. One can actually change the capture channel whilst Wireshark is running but you may miss packets whilst the channel change occurs.


I found out that pyrit can achieve a similar result:

  1. Capture wireless traffic with tshark:

    sudo tshark -i en1 -I -w wlan.pcap
  2. Analyze capture with pyrit:

    pyrit -r wlan.pcap analyze

I am using aircrack-ng on my mac, from the terminal, not emulating another OS. Here is a good page mentioning the relation to other tools, which I think may help you : http://easymactips.blogspot.com/2010/10/how-to-install-aircrack-on-mac.html

By the way, maybe you already have in the system what you are looking for: hidden in your airport is, from yosemite on, a sniffer. Press option and your wifi icon, you will see the option wireless diagnostics. Command 4 is scan (you see networks, channels, MACs, and other data) and command 6 is sniffer. Give that a try too. Best greetings.


Since aircrac-ng lacks both airodump-ng and aireplay-ng[ref. their documentation] you should look into: KisMac2. An open source wireless stumbling and security tool for Mac OS X.

Among other things it:

  • Shows logged in clients
  • Can capture packets (PCAP export possible)
  • Reveals hidden SSIDs
  • Can perform various attacks like the "deauthentication attack"

They link the zipped .dmg file at the end of the README file: KisMac2.zip.


airodump-ng (as aireplay-ng, airbase-ng, airserve-ng, airtun-ng, …) is located in /usr/local/sbin on a Mac.

Therefore you can add this path to your $PATH env variable:

echo 'export PATH="/usr/local/sbin:$PATH"' >> ~/.profile

When running a new session (opening a new terminal or running source ~..profile) you have access to airodump-ng command and all other aircrack related.


You might want to try KisMac2 : https://github.com/IGRSoft/KisMac2

  • I'm rather looking for a command line tool, not a GUI. – sdabet Aug 11 '15 at 14:15

Have you tried http://www.aircrack-ng.org/doku.php?id=install_aircrack

It has instructions to install aircrack-ng on Mac.
From the website:

Installing on Mac OSX The simplest and easiest way to install on Mac OS X is via Macports. You simply do “sudo >port install aircrack-ng”.

Alternatively, use the following instructions:

Make sure you have Xcode installed on your Mac, which can be found on the installer >CD/DVD which came with your Mac. After getting the source you can do a simple “make && >sudo make install” from the untarred directory. When you use the stable, you need to >rename the Makefile.osx to Makefile and when you use the dev version it will autodetect you are using Darwin and compile fine.

Mind you, airodump-ng and aireplay-ng are linux only and will not work under OSX native, so for reinjecting and sniffing you will have to use other means.

If you have an intel Mac check out the VMware Fusion option which is mentioned lower on >this page.

Optional is openssl-dev and sqlite3 which can be installed through fink

  • 7
    Well, as said in your quote, airodump-ng and aireplay-ng are linux only and will not work under OSX native. And it indeed does not work. That's why I'm looking for an alternative on Mac OS X (not for packet injection, just for dumping APs and clients along with the number of data packets for each AP) – sdabet Jan 23 '14 at 6:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .