Re: [Full-disclosure] Best Wireless Sniffer for MAC OS X

[David Maynor <dave@xxxxxxxxxxxxx>]

In Snow Leopard there is a built-in command called airportd. In previous 
versions of OSX you could use this to change wireless setting from the command 
line. In 10.6 you can se it to sniff on a single wireless channel.

David-Maynors-MacBook-Pro:~ dave$ /usr/libexec/airportd
Usage: airportd <interface> <verb> <options>
<cut for length>
Sniffing on channel 1:
        airportd en1 sniff 1
David-Maynors-MacBook-Pro:~ dave$

Running the command in the example will start collecting wireless packets in 
/tmp with the name airportSniffXXXXXX.cap. This is a standard pcap file 
readable by tcpdump or wireshark.

David-Maynors-MacBook-Pro:~ dave$ sudo /usr/libexec/airportd en1 sniff 1
Password:
Capturing 802.11 frames on en1.
^CSession saved to /tmp/airportSniffndDZXh.cap.
David-Maynors-MacBook-Pro:~ dave$

The downside is that while sniffing you wireless card cannot be used for normal 
operations. If this is common knowledge I apologize, I find it interesting 
Apple choose to include this ability by default. 

On Apr 13, 2010, at 12:27 PM, KF (lists) wrote:

> Pre Snow Leopard versions of OSX work fine with kismet.
> -KF
> 
> Sent from my iPad
> 
> On Apr 13, 2010, at 11:10 AM, Cody Robertson <cody@xxxxxxxxxxxx> wrote:
> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> On 4/13/10 10:41 AM, Justin Chang wrote:
>>> 
>>> Hello group
>>> What are some of the best wireless sniffers on MAC OS X platform? I want to 
>>> be able to sniff the traffic and look for sensitive information. The 
>>> company has a small budget so both free and commercial are fine
>>> Thanks                                        
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>> 
>> Wireshark should work.
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.9 (Darwin)
>> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>> 
>> iEYEARECAAYFAkvEiVoACgkQAr2PPaFwRupcvACaA5iBD/mxrEJ8xODwNr/6vLhO
>> MHkAn1/j740oDaQHueGgapfP6Off5rmW
>> =t1Bb
>> -----END PGP SIGNATURE-----
>> 
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/