Re: [Full-disclosure] Best Wireless Sniffer for MAC OS X



In Snow Leopard there is a built-in command called airportd. In previous versions of OSX you could use this to change wireless setting from the command line. In 10.6 you can se it to sniff on a single wireless channel.

David-Maynors-MacBook-Pro:~ dave$ /usr/libexec/airportd
Usage: airportd <interface> <verb> <options>
<cut for length>
Sniffing on channel 1:
airportd en1 sniff 1
David-Maynors-MacBook-Pro:~ dave$

Running the command in the example will start collecting wireless packets in /tmp with the name airportSniffXXXXXX.cap. This is a standard pcap file readable by tcpdump or wireshark.

David-Maynors-MacBook-Pro:~ dave$ sudo /usr/libexec/airportd en1 sniff 1
Password:
Capturing 802.11 frames on en1.
^CSession saved to /tmp/airportSniffndDZXh.cap.
David-Maynors-MacBook-Pro:~ dave$

The downside is that while sniffing you wireless card cannot be used for normal operations. If this is common knowledge I apologize, I find it interesting Apple choose to include this ability by default.

On Apr 13, 2010, at 12:27 PM, KF (lists) wrote:

Pre Snow Leopard versions of OSX work fine with kismet.
-KF

Sent from my iPad

On Apr 13, 2010, at 11:10 AM, Cody Robertson <cody@xxxxxxxxxxxx> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 4/13/10 10:41 AM, Justin Chang wrote:

Hello group
What are some of the best wireless sniffers on MAC OS X platform? I want to be able to sniff the traffic and look for sensitive information. The company has a small budget so both free and commercial are fine
Thanks



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Wireshark should work.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkvEiVoACgkQAr2PPaFwRupcvACaA5iBD/mxrEJ8xODwNr/6vLhO
MHkAn1/j740oDaQHueGgapfP6Off5rmW
=t1Bb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [SLE] Wireless eth0 or wlan0 ?????
    ... ifcfg-wlan-0 that contains the wireless parameters. ... >wlan0 ifup: ... >Timeout waiting for command completion. ... I'm setting the encryption keys with iwconfig. ...
    (SuSE)
  • Re: Wireless IOS upgrade on 881W
    ... The info below is on the right track - use the "archive download" command ... to load the tarball into the AP801's flash. ... However the integrated AP - do I load the file as it is on ... ~ There is a command to connect to the wireless module ...
    (comp.dcom.sys.cisco)
  • Re: [SLE] Wireless eth0 or wlan0 ?????
    ... "iwconfig" and tried to start it using "ifup". ... my wireless is still not working. ... wlan0 ifup: ... Timeout waiting for command completion. ...
    (SuSE)
  • Re: Problems with wireless after update to 9.2
    ... > I update according to the Suse Watcher. ... Upon reboot, ... Could you boot up with your wireless card and try that? ... The output from each command gets put into a .log file in the /tmp ...
    (alt.os.linux.suse)
  • Re: [SLE] Wireless eth0 or wlan0 ?????
    ... To all having wireless woes with SuSE 9.0 after online update. ... > Timeout waiting for command completion. ... I'm setting the encryption keys with iwconfig. ...
    (SuSE)