Skip to content
HackIndex logo

HackIndex

Visualising AP and Client Relationships with airgraph-ng

3 min read Mar 17, 2026

airgraph-ng generates visual graphs from airodump-ng CSV output showing the relationships between access points and their associated clients. Two graph types are available: CAPR (Client to AP Relationship) which shows which clients are connected to which APs, and CPG (Common Probe Graph) which shows which clients are probing for the same SSIDs. These graphs are useful for mapping the wireless environment at a glance after a reconnaissance session and for identifying clients associated with multiple APs or probing for interesting SSIDs.

Capture Data with airodump-ng

airgraph-ng reads the CSV file produced by airodump-ng. Capture with the --write flag to generate the CSV alongside the pcap:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --write survey --output-format csv wlan0mon

This produces survey-01.csv containing all AP and client data collected during the session. Run the capture for at least several minutes to capture client associations across all visible APs.

Install airgraph-ng

┌──(kali㉿kali)-[~]
└─$ apt update && apt install -y airgraph-ng

Generate a Client to AP Relationship Graph (CAPR)

CAPR shows every client and which AP it is or was associated with during the capture:

┌──(kali㉿kali)-[~]
└─$ airgraph-ng -i survey-01.csv -o capr-graph.png -g CAPR

Open the output image:

┌──(kali㉿kali)-[~]
└─$ eog capr-graph.png

Each AP appears as a node with its SSID and BSSID. Connected clients are shown as nodes linked to their associated AP. Clients shown as unassociated are probing but not currently connected to any visible AP — these are candidates for evil twin attacks since they are actively searching for networks.

Generate a Common Probe Graph (CPG)

CPG shows which clients are probing for the same SSIDs, revealing which devices share a common network history:

┌──(kali㉿kali)-[~]
└─$ airgraph-ng -i survey-01.csv -o cpg-graph.png -g CPG
┌──(kali㉿kali)-[~]
└─$ eog cpg-graph.png

In a CPG graph, SSID nodes are connected to all clients that have been seen probing for them. Multiple clients probing for the same internal SSID — such as a corporate VPN or internal guest network name — indicates those clients have previously connected to that network and can be targeted with an evil twin broadcasting that SSID.

Adjust Graph Layout for Large Environments

In dense environments with many APs and clients the default graph can be cluttered. Use GraphViz layout options to improve readability. airgraph-ng uses GraphViz under the hood — install it if missing:

┌──(kali㉿kali)-[~]
└─$ apt install -y graphviz

For a specific capture session, filter the CSV to a target BSSID before graphing to reduce noise. The airodump-ng CSV includes all APs and clients seen during the session — a targeted capture with --bssid produces a much cleaner graph focused on the target network.

References