In any residential building, there is a multitude of WPA2-protected wireless access points.

Yesterday I was at a friend's and attempted to launch aircrack-ng against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to aircrack-ng.

I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.

I know that the first step is to put my network card in monitor mode.

# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill> 
sudo airmon-ng start wlan0 2

As a second step, I attempted iwlist scan. However, this returned only a list of AP-s, that is, devices in Master mode.

Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?

Can I use something line tcpdump wlan0 to do this? If yes, how can I get the MAC data out of the packets?

  • 1
    This question appears to be off-topic because it is asking for help regarding the usage and operation of specific tools in a specific case. Such information is freely available all over the Internet. Voted to close. – Adi Sep 5 '13 at 9:30
  • @Adnan, well, I am asking which tools to use. Reading manuals, while pedagogical, is very time consuming, if the manual refers to the wrong tool. – Vorac Sep 5 '13 at 11:54
  • Plus, I am asking if there exists ongoing communication between a (passive) authenticated device and the AP. If the answer is "no", then no tool would help me! – Vorac Sep 5 '13 at 11:55

You are searching for airodump-ng (interface) !

Main steps in short:

1) Put monitor mode


2) Dump (This step is what you are searching for)

airodump-ng mon0

3) Generate some traffic


Wait for the handshake.

4) Crack it with a list

Use the John the Ripper as word list to crack the WPA/WP2 password.

aircrack-ng -w /pentest/passwords/john/password.lst wpacrack-01.ivs

Here is the full description! (I assume you use BT)

backtrack wep crack

HOWTO : WPA/WPA2 cracking with Back|Track 5

  • I was using this tutorial where they assume I know the client's MAC. Will airodump-ng report a device, that is already authenticated prior to my arrival at the scene? – Vorac Sep 5 '13 at 12:05
  • According to this site link ! What's the meaning of the fields displayed by airodump-ng ? Airodump-ng will display a list of detected access points! – Raymond Sep 5 '13 at 12:17
  • Oh, I get it now - airodump listens to any packets, directed at the AP. Then, if I did not capture a valid handshake, use the listed MAC to de-authenticate the client. Got it. – Vorac Sep 5 '13 at 12:23

You can also use Kismet in order to passively scan for wireless devices, it comes with Kali Linux distribution (formerly Backtrack).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.