1

when I run the command airport, it tells me it is sniffing:

Sniffing on channel 1:
    airport en1 sniff 1

I have noticed that many log files are created in /private/tmp

There may be some bad actor that has done this to my mac.

How can I disable airport from sniffing?

I killed it using its PID, but it starts again.

Improve this question
2
  • I couldn't test running airport, as I'd have to do this all on Mojave. But looks like you read from the Examples from the help page
    – anki
    Commented Nov 26, 2019 at 9:19
  • 1
    @ankii You can run it by just pasting /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport into Terminal
    – nohillside ♦
    Commented Nov 26, 2019 at 9:27

1 Answer 1

Reset to default
2

If you run airport without arguments it just prints a description of its options and examples of how to use some of them, including airport en1 sniff 1 to start sniffing. It does not report the current state of the interface.

To actually start sniffing you need to call the command as shown (and replace en1 with your actual WiFi interface):

$ sudo airport en1 sniff
Capturing 802.11 frames on en1.
^CSession saved to /tmp/airportSniffHZ3nqn.cap.
$ ll /tmp/airportSniffHZ3nqn.cap 
-rw-r--r--  1 root  wheel  24 Nov 26 10:10 /tmp/airportSniffHZ3nqn.cap

It will keep running (and capturing) until you press Ctrl-C. To analyze the captured data you can use tcpdump or Wireshark.

Improve this answer
6
  • apple.stackexchange.com/questions/376041/…. chatroom has all my suggestions negated.
    – anki
    Commented Nov 26, 2019 at 9:12
  • @ankii Thanks. That seems unrelated to anything airport might do. airport logs (if enabled) are written to /var/log/wifi.log.
    – nohillside ♦
    Commented Nov 26, 2019 at 9:19
  • you can see the edit history.. I re-added airport tag after they added the sniff part. I added my defence (;p) in the comment above.
    – anki
    Commented Nov 26, 2019 at 9:20
  • 1
    @ankii airport != Airport Utility. The first is used to manage the local WiFi interface, the second to manage an Airport device (WiFi router). I've removed the tag again nevertheless because assuming Airport Utility is involved goes beyond what the OP provided so far.
    – nohillside ♦
    Commented Nov 26, 2019 at 9:23
  • The contents of the log files at /private/tmp/wifi-11-25-2019__21:01:30.log contain lines saying airportd. Perhaps something else is doing this logging.
    – tread
    Commented Nov 26, 2019 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .