when I run the command airport, it tells me it is sniffing:

Sniffing on channel 1:
    airport en1 sniff 1

I have noticed that many log files are created in /private/tmp

There may be some bad actor that has done this to my mac.

How can I disable airport from sniffing?

I killed it using its PID, but it starts again.

  • I couldn't test running airport, as I'd have to do this all on Mojave. But looks like you read from the Examples from the help page – anki Nov 26 '19 at 9:19
  • 1
    @ankii You can run it by just pasting /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport into Terminal – nohillside Nov 26 '19 at 9:27

If you run airport without arguments it just prints a description of its options and examples of how to use some of them, including airport en1 sniff 1 to start sniffing. It does not report the current state of the interface.

To actually start sniffing you need to call the command as shown (and replace en1 with your actual WiFi interface):

$ sudo airport en1 sniff
Capturing 802.11 frames on en1.
^CSession saved to /tmp/airportSniffHZ3nqn.cap.
$ ll /tmp/airportSniffHZ3nqn.cap 
-rw-r--r--  1 root  wheel  24 Nov 26 10:10 /tmp/airportSniffHZ3nqn.cap

It will keep running (and capturing) until you press Ctrl-C. To analyze the captured data you can use tcpdump or Wireshark.

  • apple.stackexchange.com/questions/376041/…. chatroom has all my suggestions negated. – anki Nov 26 '19 at 9:12
  • @ankii Thanks. That seems unrelated to anything airport might do. airport logs (if enabled) are written to /var/log/wifi.log. – nohillside Nov 26 '19 at 9:19
  • you can see the edit history.. I re-added airport tag after they added the sniff part. I added my defence (;p) in the comment above. – anki Nov 26 '19 at 9:20
  • 1
    @ankii airport != Airport Utility. The first is used to manage the local WiFi interface, the second to manage an Airport device (WiFi router). I've removed the tag again nevertheless because assuming Airport Utility is involved goes beyond what the OP provided so far. – nohillside Nov 26 '19 at 9:23
  • The contents of the log files at /private/tmp/wifi-11-25-2019__21:01:30.log contain lines saying airportd. Perhaps something else is doing this logging. – stephen Nov 26 '19 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .