Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.

From man iwconfig mode Monitor does the following:

"the node is not associated with any cell and passively monitor all packets on the frequency"

share|improve this question

What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. It's a binary command, which I've symlinked into /usr/local/bin/ for convenience.

Creating Symlink:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport

Example of sniffing in monitor mode:

sudo airport en1 sniff 1

This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap (where XXXXXX will vary). You can view this with tcpdump -r <filename> or by opening it in wireshark.

To search for active channels nearby that you can sniff, run this:

sudo airport en1 -s

Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.

share|improve this answer
It Works. Just a side note, the capture file extension is .cap and not .pcap as described. (OS X Mavericks 10.9) – Vitim.us Apr 21 '14 at 1:25
this works in yosemite as well – jeremyforan Oct 7 '14 at 14:13

You can also do it via the GUI if that is easier for you.

In Mavericks:

  • Search Spotlight (Command+Space) for "Wireless Diagnostics"
  • When the application opens, press Command+2 or go to Window > Utilities to open the Utilities Window
  • Click on the Frame Capture Tab
  • Rename the output .wcap file to .pcap for use with Eye P.A.
share|improve this answer
Woah, Narnia! I didn't even know this existed! – Matt Oct 24 '14 at 5:38

Pass the -I flag to tcpdump or tshark (wireshark command-line utility).

For example, to save everything from radiotap headers down to the application layer packets to a file named 'save.pcap':

tcpdump -Ini en0 -w save.pcap

Or to examine probe request 802.11 management frames live:

tshark -Ini en0 -s 256 type mgt subtype probe-req

Note, one OS X you will have to run the commands as root or grant yourself permission to access the kernel's packet filters:

sudo chmod 0644 /dev/bpf*
share|improve this answer

by default on OSX en0 is your ethernet port, while en1 is your airport


iwconfig en1 mode monitor
share|improve this answer
There's no such command on Mac OS X. – bahamat Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that – h3rrmiller Sep 27 '12 at 19:36
You must have obtained it from somewhere else, it's not part of Mac OS X. – bahamat Sep 27 '12 at 19:54
"by default on OSX en0 is your ethernet port" If you have an Ethernet port. My MacBook Pro has no Ethernet port; en0 is the AirPort interface, and, if I plug in a Thunderbolt-to-Ethernet adapter, it becomes en2. – user44841 Feb 28 '15 at 10:01
iwconfig is a Linux command; are you sure you typed that command on a Mac running OS X and, if so, where did you get the iwconfig program? – user44841 Feb 28 '15 at 10:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.