Skip to content
HackIndex.io

Passive Wireless Scanning with airodump-ng

4 min read Created Mar 17, 2026 Last updated Sep 12, 2026

airodump-ng is the primary tool for passive wireless reconnaissance. It captures 802.11 frames and displays a live view of every access point and client visible to your adapter. No frames are injected during passive scanning: the adapter listens only.

Monitor mode must be active before running airodump-ng. See the monitor mode setup page if needed.

Start airodump-ng for Passive Scanning

Start a scan across all channels on the default band:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 CH  9 ][ Elapsed: 12 s ][ 2024-03-15 14:22

 BSSID              PWR  Beacons    #Data  #/s  CH   MB   ENC CIPHER  AUTH ESSID

 AA:BB:CC:DD:EE:FF  -42       87       14    0   6  130   WPA2 CCMP    PSK  TargetNetwork
 11:22:33:44:55:66  -67       43        0    0  11  195   WPA2 CCMP    PSK  HomeNetwork
 77:88:99:AA:BB:CC  -81       12        0    0  36  405   WPA3 CCMP    SAE  OfficeNet

 BSSID              STATION            PWR   Rate    Lost    Frames  Notes   Probes

 AA:BB:CC:DD:EE:FF  FF:EE:DD:CC:BB:AA  -55    54e-54e    0       42

The top section lists access points. The bottom section lists associated clients. Key columns to note:

  • PWR: signal strength in dBm. Closer to 0 is stronger. Values below -80 are weak and may cause unreliable captures.

  • CH: the channel the AP is operating on.

  • ENC / CIPHER / AUTH: encryption type. WPA2 PSK is the most common target. WPA3 SAE uses the Dragonfly handshake and resists offline cracking.

  • ESSID: the network name. Hidden networks show as blank or <length: 0>.

  • STATION: client MAC addresses associated to each BSSID.

Channel Hopping and Band Coverage

By default airodump-ng hops across 2.4 GHz channels. To include 5 GHz channels, specify the band explicitly:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --band abg wlan0mon

Band flags control which frequencies airodump-ng hops across:

  • a: 5 GHz channels

  • b: 2.4 GHz channels (802.11b rates)

  • g: 2.4 GHz channels (802.11g rates)

Using all three gives full dual-band coverage at the cost of slower channel hopping. If you are only targeting a specific band, restrict accordingly to spend more time per channel:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --band a wlan0mon

For Wi-Fi 6 (802.11ax) networks on 5 GHz, the same --band a flag applies. Wi-Fi 6E operates on 6 GHz and requires an adapter that supports the 6 GHz band: most current pentesting adapters including the Alfa AWUS036ACM do not. Check adapter specifications before assuming 6 GHz coverage.

Lock to a Specific Channel

Once you have identified a target AP, lock to its channel to avoid missing frames during hops:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --channel 6 wlan0mon

Target a Specific BSSID

Filter output and capture to a single AP to reduce noise and keep file sizes manageable:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture wlan0mon

--write capture saves output to multiple files. The -01 suffix increments automatically if the file already exists. Default output files:

  • .cap: packet capture in pcap format, used for handshake cracking

  • .csv: comma-separated list of APs and clients

  • .kismet.csv: Kismet-compatible CSV with extended metadata

  • .kismet.netxml: XML format compatible with Kismet and other tools

Write Multiple Output Formats

To control which formats are written:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture --output-format pcap,csv wlan0mon

Identify Hidden SSIDs

Hidden networks suppress their SSID in beacon frames but still reveal it in probe request and probe response frames when a client connects. Keep airodump-ng running on the target channel and watch the ESSID column: it will populate as soon as a client associates or reassociates.

Hidden networks still appear in the AP list with a blank ESSID or a length indicator. The BSSID, channel, and encryption type are always visible regardless of SSID hiding.

GPS Logging

If a GPS device is connected and gpsd is running, pass --gpsd so airodump-ng connects to the daemon and logs coordinates for each AP:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --gpsd --write capture --output-format pcap,csv,kismet,netxml wlan0mon

The .kismet.csv and .kismet.netxml files include GPS coordinates when available. Useful for wardriving or site survey work.

References