# Passive Wireless Scanning with airodump-ng

> Capture 802.11 frames passively using airodump-ng to enumerate SSIDs, BSSIDs, clients, channels, and encryption types without transmitting packets.

- **URL:** https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-airodump-ng
- **Path:** Wireless > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/wireless/reconnaissance.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-12

airodump-ng is the primary tool for passive wireless reconnaissance. It captures 802.11 frames and displays a live view of every access point and client visible to your adapter. No frames are injected during passive scanning: the adapter listens only.

Monitor mode must be active before running airodump-ng. See the monitor mode setup page if needed.

## Start airodump-ng for Passive Scanning

Start a scan across all channels on the default band:

```bash
airodump-ng wlan0mon
#  CH  9 ][ Elapsed: 12 s ][ 2024-03-15 14:22
#
#  BSSID              PWR  Beacons    #Data  #/s  CH   MB   ENC CIPHER  AUTH ESSID
#
#  AA:BB:CC:DD:EE:FF  -42       87       14    0   6  130   WPA2 CCMP    PSK  TargetNetwork
#  11:22:33:44:55:66  -67       43        0    0  11  195   WPA2 CCMP    PSK  HomeNetwork
#  77:88:99:AA:BB:CC  -81       12        0    0  36  405   WPA3 CCMP    SAE  OfficeNet
#
#  BSSID              STATION            PWR   Rate    Lost    Frames  Notes   Probes
#
#  AA:BB:CC:DD:EE:FF  FF:EE:DD:CC:BB:AA  -55    54e-54e    0       42
```

The top section lists access points. The bottom section lists associated clients. Key columns to note:

- **PWR**: signal strength in dBm. Closer to 0 is stronger. Values below -80 are weak and may cause unreliable captures.
- **CH**: the channel the AP is operating on.
- **ENC / CIPHER / AUTH**: encryption type. WPA2 PSK is the most common target. WPA3 SAE uses the Dragonfly handshake and resists offline cracking.
- **ESSID**: the network name. Hidden networks show as blank or <length: 0>.
- **STATION**: client MAC addresses associated to each BSSID.

## Channel Hopping and Band Coverage

By default airodump-ng hops across 2.4 GHz channels. To include 5 GHz channels, specify the band explicitly:

```bash
airodump-ng --band abg wlan0mon
```

Band flags control which frequencies airodump-ng hops across:

- **`a`**: 5 GHz channels
- **`b`**: 2.4 GHz channels (802.11b rates)
- **`g`**: 2.4 GHz channels (802.11g rates)

Using all three gives full dual-band coverage at the cost of slower channel hopping. If you are only targeting a specific band, restrict accordingly to spend more time per channel:

```bash
airodump-ng --band a wlan0mon
```

For Wi-Fi 6 (802.11ax) networks on 5 GHz, the same `--band a` flag applies. Wi-Fi 6E operates on 6 GHz and requires an adapter that supports the 6 GHz band: most current pentesting adapters including the Alfa AWUS036ACM do not. Check adapter specifications before assuming 6 GHz coverage.

## Lock to a Specific Channel

Once you have identified a target AP, lock to its channel to avoid missing frames during hops:

```bash
airodump-ng --channel 6 wlan0mon
```

## Target a Specific BSSID

Filter output and capture to a single AP to reduce noise and keep file sizes manageable:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture wlan0mon
```

`--write capture` saves output to multiple files. The `-01` suffix increments automatically if the file already exists. Default output files:

- **`.cap`**: packet capture in pcap format, used for handshake cracking
- **`.csv`**: comma-separated list of APs and clients
- **`.kismet.csv`**: Kismet-compatible CSV with extended metadata
- **`.kismet.netxml`**: XML format compatible with Kismet and other tools

## Write Multiple Output Formats

To control which formats are written:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture --output-format pcap,csv wlan0mon
```

## Identify Hidden SSIDs

Hidden networks suppress their SSID in beacon frames but still reveal it in probe request and probe response frames when a client connects. Keep airodump-ng running on the target channel and watch the ESSID column: it will populate as soon as a client associates or reassociates.

Hidden networks still appear in the AP list with a blank ESSID or a length indicator. The BSSID, channel, and encryption type are always visible regardless of SSID hiding.

## GPS Logging

If a GPS device is connected and `gpsd` is running, pass `--gpsd` so airodump-ng connects to the daemon and logs coordinates for each AP:

```bash
airodump-ng --gpsd --write capture --output-format pcap,csv,kismet,netxml wlan0mon
```

The `.kismet.csv` and `.kismet.netxml` files include GPS coordinates when available. Useful for wardriving or site survey work.

## References

- [Aircrack-ng: airodump-ng documentation](https://www.aircrack-ng.org/doku.php?id=airodump-ng) - Full flag reference including band, output format, and GPS options