# Visualising AP and Client Relationships with airgraph-ng

> Maps wireless network topology by graphing AP-to-client relationships from airodump-ng capture data, revealing association patterns and potential targets.

- **URL:** https://hackindex.io/platforms/wireless/post-exploitation/visualising-ap-client-relationships-airgraph-ng
- **Path:** Wireless > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/wireless/post-exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

airgraph-ng generates visual graphs from airodump-ng CSV output showing the relationships between access points and their associated clients. Two graph types are available: CAPR (Client to AP Relationship) which shows which clients are connected to which APs, and CPG (Common Probe Graph) which shows which clients are probing for the same SSIDs. These graphs are useful for mapping the wireless environment at a glance after a reconnaissance session and for identifying clients associated with multiple APs or probing for interesting SSIDs.

## Capture Data with airodump-ng

airgraph-ng reads the CSV file produced by airodump-ng. Capture with the `--write` flag to generate the CSV alongside the pcap:

```bash
airodump-ng --write survey --output-format csv wlan0mon
```

This produces `survey-01.csv` containing all AP and client data collected during the session. Run the capture for at least several minutes to capture client associations across all visible APs.

## Install airgraph-ng

```bash
apt update && apt install -y airgraph-ng
```

## airgraph-ng AP Client Visualisation with CAPR

CAPR shows every client and which AP it is or was associated with during the capture:

```bash
airgraph-ng -i survey-01.csv -o capr-graph.png -g CAPR
```

Open the output image:

```bash
eog capr-graph.png
```

Each AP appears as a node with its SSID and BSSID. Connected clients are shown as nodes linked to their associated AP. What to look for in the CAPR graph:

- Unassociated clients (probing but not connected) are candidates for evil twin attacks since they are actively searching for networks.
- APs with many clients indicate high-value targets where deauthentication will generate the most handshakes.
- Clients connected to multiple APs may be roaming devices (laptops, phones) that are easier to pull to a rogue AP.
- Hidden SSIDs appear as empty or null nodes. Cross-reference with probe requests from the CPG graph to identify them.

## Generate a Common Probe Graph (CPG)

CPG shows which clients are probing for the same SSIDs, revealing which devices share a common network history:

```bash
airgraph-ng -i survey-01.csv -o cpg-graph.png -g CPG
```

```bash
eog cpg-graph.png
```

In a CPG graph, SSID nodes are connected to all clients that have been seen probing for them. Multiple clients probing for the same internal SSID (such as a corporate VPN or internal guest network name) indicates those clients have previously connected to that network and can be targeted with an evil twin broadcasting that SSID.

## Adjust Graph Layout for Large Environments

In dense environments with many APs and clients the default graph can be cluttered. Use GraphViz layout options to improve readability. airgraph-ng uses GraphViz under the hood: install it if missing:

```bash
apt install -y graphviz
```

For a specific capture session, filter the CSV to a target BSSID before graphing to reduce noise. The airodump-ng CSV includes all APs and clients seen during the session: a targeted capture with `--bssid` produces a much cleaner graph focused on the target network.

## References

- [Aircrack-ng: airgraph-ng documentation](https://www.aircrack-ng.org/doku.php?id=airgraph-ng) - CAPR and CPG graph type reference and CSV input format