How do I configure a tool like wireshark, kismet, tcpdump to passively listen to wifi traffic?

How do I get one of these tools to print these MAC addresses to stdout? I want just one MAC address per line. I want them to print each MAC address they detect, I don't care whether they detected that certain address before.

  • In your area or on your network? The tools you mention are network tools, not wifi spying tools. Also show us what you did so far and didn't work. The point of this site is to help you, not to get your work done by others. Jul 8 '16 at 15:58
  • Passively listening to network traffic can be attained by setting your NIC to promiscuous mode. Just google the term and you will find how to do this, but I highly doubt you want this, unless you will dedicate a machine to sit, do nothing but listen to wi-fi traffic, with no other network connectivity. Look into using arp or nmap. Both of them provide MAC addresses as well as associated IP addresses. It is up to you to format the output to your desire
    – MelBurslan
    Jul 8 '16 at 16:07
  • @julie 1. I want to sniff one network in particular, but I don't want to be logged in to that network, so I wouldn't consider it "my network". It's a wifi using 802.1x authentication. 2. I don't understand how to configure and use the tools I mentioned. I also could not find a tutorial explaining it to me in a way I am able to understand it.
    – spilot
    Jul 8 '16 at 16:11
  • @MelBurslan I want to do exactly that, actually.
    – spilot
    Jul 8 '16 at 16:12
  • 1
    @MelBursian Let's not defamate anyone. Spilot didn't say anything about illegal activities. We should assume he's acting within the law. I personally see no reason why I can't listen to unencrypted MAC addresses being broadcasted into my home/office if I want to. I have wifi analysing software that supports this as well that I use professionally. We don't know what the situation with spilot is. Jul 8 '16 at 16:43

Listen on a wifi network that you are connected to or any network?

Connected network with tcpdump

$ tcpdump -le | egrep -o '([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})'

Not connected with aircrack-ng

For watching all wifi traffic, even on different SSIDs you'll need something like aircrack-ng's airodump-ng. I'm not setup to use it right now, so I can't help with formatting it's output as I did with tcpdump. It can save output to various file formats that perhaps you can process with grep in the same way.

The console output looks like this:

 ss #1

airodump-ng documentation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.