Because it supports monitor mode, a Macbook with the built-in WiFi adapter is one of the simplest ways to grab packets off the air. It’s not the most robust, but often all I need to do is grab data from a couple devices I’m near on a known channel, so fancy antennas and channel hopping and whatnot is overkill; I just need to grab packets. Using the Sniffer built into the Wireless Diagnostics captures in Monitor Mode has been fairly easy for a while, but I was stuck using the GUI.
For a while macOS has had a command line utility called
airport to handle all sorts of wireless network manipulation, log gathering, and debugging. It also has a poorly documented command verb
sniff, but until the release of macOS Sonoma (14.0) it was only possible to specifying the channel. Not being able to specify the width made it useless for most capturing I’d do in the real world.
airport command now works for channel and width, so now it’s possible to use remotely, in scripts, etc. It’s not well documented, but it works. For example, the following will capture on
en0 on 5GHz channel 137 with 80MHz width:
airport en0 sniff 5g137/80
This will capture
en1 on 2.4GHz channel 7 at 20MHz width:
airport en0 sniff 2g7/20
(I suspect that sniffing from 6GHz WiFi will follow the same pattern, but I don’t have access to a device with such a radio so I’m unable to test. It’d also be pretty nifty to see this somehow built in / better automated via Wireshark… That could be a neat project for later.)
airport binary can be found at
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport. I link this to
~/bin, with something like the following:
ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport ~/bin/airport
~/bin around for personal executable stuff, and it’s been added to my path by putting a line like this in
airport binary itself has a pretty decent output from
--help. It’s light on sniffing examples, but pretty good for other stuff.
Amusingly, this is pretty much the extent of the
airport(8) man page; a TODO:
airport manages 802.11 interfaces. airport more information needed here.