Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm searching for a equivalent of "iwconfig eth0 mode Monitor" in Mac OS.

From man iwconfig mode Monitor does the following:

"the node is not associated with any cell and passively monitor all packets on the frequency"

share|improve this question

2 Answers

up vote 1 down vote

What you're looking for is /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. It's a binary command, which I've symlinked into /usr/local/bin/ for convenience.

Example of sniffing in monitor mode:

sudo airport en1 sniff 1

This sniffs on channel 1 and saves a pcap capture file to /tmp/airportSniffXXXXXX.pcap (where XXXXXX will vary). You can view this with tcpdump -r <filename> or by opening it in wireshark.

To search for active channels nearby that you can sniff, run this:

sudo airport en1 -s

Although you can capture any traffic, you can only effectively read if the network is open or you have the encryption key.

share|improve this answer
up vote 0 down vote

by default on OSX en0 is your ethernet port, while en1 is your airport

try:

iwconfig en1 mode monitor
share|improve this answer
There's no such command on Mac OS X. – bahamat Sep 27 '12 at 19:31
strange, I just ran it... and it worked... and thanks for changing the interface names, forgot about that – h3rrmiller Sep 27 '12 at 19:36
You must have obtained it from somewhere else, it's not part of Mac OS X. – bahamat Sep 27 '12 at 19:54
yeah, pretty sure you're right – h3rrmiller Sep 27 '12 at 23:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.