Skip to content
HackIndex logo

HackIndex

Passive Wireless Scanning with airodump-ng

3 min read Mar 17, 2026

airodump-ng is the primary tool for passive wireless reconnaissance. It captures 802.11 frames and displays a live view of every access point and client visible to your adapter. No frames are injected during passive scanning — the adapter listens only.

Monitor mode must be active before running airodump-ng. See the monitor mode setup page if needed.

Basic Scan

Start a scan across all channels on the default band:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 CH  9 ][ Elapsed: 12 s ][ 2024-03-15 14:22

 BSSID              PWR  Beacons    #Data  #/s  CH   MB   ENC CIPHER  AUTH ESSID

 AA:BB:CC:DD:EE:FF  -42       87       14    0   6  130   WPA2 CCMP    PSK  TargetNetwork
 11:22:33:44:55:66  -67       43        0    0  11  195   WPA2 CCMP    PSK  HomeNetwork
 77:88:99:AA:BB:CC  -81       12        0    0  36  405   WPA3 CCMP    SAE  OfficeNet

 BSSID              STATION            PWR   Rate    Lost    Frames  Notes   Probes

 AA:BB:CC:DD:EE:FF  FF:EE:DD:CC:BB:AA  -55    54e-54e    0       42

The top section lists access points. The bottom section lists associated clients. Key columns to note:

  • PWR — signal strength in dBm. Closer to 0 is stronger. Values below -80 are weak and may cause unreliable captures.
  • CH — the channel the AP is operating on.
  • ENC / CIPHER / AUTH — encryption type. WPA2 PSK is the most common target. WPA3 SAE uses the Dragonfly handshake and resists offline cracking.
  • ESSID — the network name. Hidden networks show as blank or <length: 0>.
  • STATION — client MAC addresses associated to each BSSID.

Channel Hopping and Band Coverage

By default airodump-ng hops across 2.4 GHz channels. To include 5 GHz channels, specify the band explicitly:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --band abg wlan0mon

a covers 5 GHz, b and g cover 2.4 GHz. Using all three gives full dual-band coverage at the cost of slower channel hopping. If you are only targeting a specific band, restrict accordingly to spend more time per channel:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --band a wlan0mon

For Wi-Fi 6 (802.11ax) networks on 5 GHz, the same --band a flag applies. Wi-Fi 6E operates on 6 GHz and requires an adapter that supports the 6 GHz band — most current pentesting adapters including the Alfa AWUS036ACM do not. Check adapter specifications before assuming 6 GHz coverage.

Lock to a Specific Channel

Once you have identified a target AP, lock to its channel to avoid missing frames during hops:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --channel 6 wlan0mon

Target a Specific BSSID

Filter output and capture to a single AP to reduce noise and keep file sizes manageable:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture wlan0mon

--write capture saves output to capture-01.cap plus CSV, NetXML, and kismet files. The .cap file is used for handshake cracking. The -01 suffix increments automatically if the file already exists.

Write Multiple Output Formats

To control which formats are written:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture --output-format pcap,csv wlan0mon

Identify Hidden SSIDs

Hidden networks suppress their SSID in beacon frames but still reveal it in probe request and probe response frames when a client connects. Keep airodump-ng running on the target channel and watch the ESSID column — it will populate as soon as a client associates or reassociates.

Hidden networks still appear in the AP list with a blank ESSID or a length indicator. The BSSID, channel, and encryption type are always visible regardless of SSID hiding.

GPS Logging

If a GPS device is connected and gpsd is running, airodump-ng logs coordinates for each AP automatically:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --write capture --output-format pcap,csv,kismet,netxml wlan0mon

The .kismet.csv and .kismet.netxml files include GPS coordinates when available. Useful for wardriving or site survey work.

References