Wireless - Monitor Mode

Joined
Nov 10, 2011
Messages
2
Reaction score
0
Points
1
Is it possible change your wireless mode to monitor mode on Mac OS X? I've done some research but all I found was something about AirPort Extreme, on Wikipedia. I know that this capability is available on some UNIX OSs (e.g. Ubuntu and can be done easily with the command "iwconfig <interface> mode monitor"). Does the AirPort not support monitor mode?

I'm using a 2.5 year-old MacBook running OS X (Version 10.6.8)

Thanks,
Josh
 

BrianLachoreVPI


Retired Staff
Joined
Feb 24, 2011
Messages
3,733
Reaction score
124
Points
63
Location
Maryland
Your Mac's Specs
March 2011 15" MBP 2.3GHz i7 Quad Core 8GB Ram | Mid 2011 27" iMac 3.4 GHz i7 16 GB RAM 2 TB HDD
I did a quick google search on promiscuous mode mac os x - and came across this link. Looks like you can get part of what you're probably looking for.

CaptureSetup/WLAN - The Wireshark Wiki
 
OP
J
Joined
Nov 10, 2011
Messages
2
Reaction score
0
Points
1
Brian, thanks for your reply, problem solved! I guess you can't turn on monitor mode from the Terminal, and have to use Wireshark instead. In case anybody runs into this question in the future, here's how to fix it.

1. Install Wireshark from www.wireshark.org/dowload.html
2. Launch Wireshark and select the interface you would like to capture on.
3. Stop capturing.
4. In the menu bar go to Capture > Options...
5. In the capture group box, check the check boxes "Capture packets in promiscuous mode" AND "Capture packets in monitor mode" (these options will allow you to sniff all IEEE 802.11 web traffic that your device is capable of sniffing)
6. Click the Start button
 
Joined
Jan 4, 2013
Messages
1
Reaction score
0
Points
1
Enable monitor mode from terminal

It is possible to enable monitor mode from Terminal.

-- Most OS versions have a private framework called "Airport"
-- This is your WiFi scanning framework
-- You can enable it through the terminal with the following commands

1) Enter --> "sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/\ Versions/Current/Resources/airport /usr/sbin/airport" <-- without quotes.

-- This moves our private framework (airport) to our sbin
-- This allows us to simply open terminal and type "airport -s" to scan the WiFi networks
-- To enable sniffing you need to enter this command...

2) Enter --> "sudo airport sniff CHANNEL" <-- replacing CHANNEL with the channel number you would like to sniff.

-- This enables monitor mode, continuously scanning on the channel you provide.
-- To exit monitor mode you press ^C or (CTRL+C) this will save a dump file to your /tmp/ folder under the extension .cap

***
-- If for some reason you don't exit with ^C your computer will be stuck in monitor mode.
-- To fix this enter --> "ps -A" <-- find the line that contains "airport sniff CHANNEL" and look at the corresponding number.
-- Then enter --> "sudo kill -9 NUMBER" replacing NUMBER with the number corresponding to the line in ps -A.
***

-- Hope this helps!
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top