| Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision |
| airodump-ng [2010/10/04 22:53] – Enhanced description of fixed channel troubleshooting tip darkaudax | airodump-ng [2014/05/19 22:22] – [Usage] documented -t as short form for --encrypt darkaudax |
|---|
| |
| Filter options: | Filter options: |
| --encrypt <suite> : Filter APs by cipher suite | --encrypt <suite> : Filter APs by cipher suite (short form: -t) |
| --netmask <netmask> : Filter APs by mask | --netmask <netmask> : Filter APs by mask |
| --bssid <bssid> : Filter APs by BSSID | --bssid <bssid> : Filter APs by BSSID |
| |
| RXQ expanded:\\ | RXQ expanded:\\ |
| Its measured over all management and data frames. That's the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP. | Its measured over all management and data frames. The received frames contain a sequence number which is added by the sending access point. RXQ = 100 means that all packets were received from the access point in numerical sequence and none were missing. That's the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP. |
| |
| N.B.: RXQ column will only be shown if you are locked on a single channel, not channel hopping. | N.B.: RXQ column will only be shown if you are locked on a single channel, not channel hopping. |
| ==== Limiting Data Capture to a Single AP ==== | ==== Limiting Data Capture to a Single AP ==== |
| |
| To limit the data capture to a single AP you are interested in, include the "- -bssid" option and specificy the AP MAC address. For example: "airodump-ng -c 8 - -bssid 00:14:6C:7A:41:20 -w capture ath0". | To limit the data capture to a single AP you are interested in, include the "- -bssid" option and specify the AP MAC address. For example: "airodump-ng -c 8 - -bssid 00:14:6C:7A:41:20 -w capture ath0". |
| |
| ==== How to Minimize Disk Space for Captures ==== | ==== How to Minimize Disk Space for Captures ==== |
| It is critical that the root cause of the problem be eliminated and then airodump-ng restarted again. Here are some possible reasons and how to correct them: | It is critical that the root cause of the problem be eliminated and then airodump-ng restarted again. Here are some possible reasons and how to correct them: |
| |
| * There is one or more intefaces in "managed mode" and these are are scanning for an AP to connect to. Do not use any command, process or program to connect to APs at the same time as you use the aircrack-ng suite. | * There is one or more interfaces in "managed mode" and these are are scanning for an AP to connect to. Do not use any command, process or program to connect to APs at the same time as you use the aircrack-ng suite. |
| * Other processes are changing the channel. A common problem are network managers. You can also use "airmon-ng check" on current versions of the aircrack-ng suite to identify problem processes. Then use "kill" or "killall" to destroy the problem processes. For example, use “killall NetworkManager && killall NetworkManagerDispatcher” to eliminate network managers. | * Other processes are changing the channel. A common problem are network managers. You can also use "airmon-ng check" on current versions of the aircrack-ng suite to identify problem processes. Then use "kill" or "killall" to destroy the problem processes. For example, use “killall NetworkManager && killall NetworkManagerDispatcher” to eliminate network managers. |
| * If you are using the madwifi-ng driver and have more then the ath0 interface created, the driver may be automatically scanning on the other interfaces. To resolve this, stop all interfaces except ath0. | * If you are using the madwifi-ng driver and have more then the ath0 interface created, the driver may be automatically scanning on the other interfaces. To resolve this, stop all interfaces except ath0. |
