Skip to content

Airodump-ng Cheat Sheet

airodump-ng is used to capture raw 802.11 frames and perform wireless reconnaissance. It is essential for discovering access points, clients, channels, encryption types, and capturing WPA/WPA2 handshakes.

Basic Usage

airodump-ng wlan0mon

Shows nearby: - Access Points (BSSID, ESSID) - Clients (STATION) - Channel, Encryption, Power

Write Capture Files

airodump-ng -w capture wlan0mon

Outputs: - capture-01.cap - capture-01.csv - capture-01.kismet.netxml

Channel Lock

airodump-ng -c 6 wlan0mon

Locks capture to channel 6.

Target Specific BSSID

airodump-ng --bssid AA:BB:CC:DD:EE:FF wlan0mon

Target BSSID + Channel + Output

airodump-ng -c 11 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

Capture WPA Handshake

airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

Tip

Use aireplay-ng -0 to force client reauthentication.

Monitor Clients Only

airodump-ng --bssid AA:BB:CC:DD:EE:FF wlan0mon

Clients appear under STATION section.

Hide Known Networks

airodump-ng --essid-regex "^$" wlan0mon

Shows hidden ESSIDs.

Band Selection (2.4 / 5 GHz)

airodump-ng --band abg wlan0mon
  • a → 5 GHz
  • bg → 2.4 GHz

GPS Mapping (Optional)

airodump-ng --gpsd wlan0mon

Requires GPS device.

Typical Handshake Workflow

airmon-ng start wlan0
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

Output Indicators

  • WPA handshake: shown in top-right corner
  • Power: signal strength
  • #Data: packets captured

Common Issues

No handshake captured
  • No active clients
  • Wrong channel
  • Weak signal
Fixed channel error
  • Disable NetworkManager
  • Lock channel manually
  • aircrack-ng – crack keys
  • aireplay-ng – deauth attacks
  • airmon-ng – monitor mode
  • wireshark – packet analysis

Use Cases

  • Wi-Fi reconnaissance
  • Handshake capture
  • Client enumeration
  • Pre-attack intelligence

Danger

Use only on networks you own or have permission to test.