Full Disclosure: Re: Best Wireless Sniffer for MAC OS X

[David Maynor <dave () erratasec com>]

In Snow Leopard there is a built-in command called airportd. In previous versions of OSX you could use this to change 
wireless setting from the command line. In 10.6 you can se it to sniff on a single wireless channel.

David-Maynors-MacBook-Pro:~ dave$ /usr/libexec/airportd
Usage: airportd <interface> <verb> <options>
<cut for length>
Sniffing on channel 1:
        airportd en1 sniff 1
David-Maynors-MacBook-Pro:~ dave$

Running the command in the example will start collecting wireless packets in /tmp with the name airportSniffXXXXXX.cap. 
This is a standard pcap file readable by tcpdump or wireshark.

David-Maynors-MacBook-Pro:~ dave$ sudo /usr/libexec/airportd en1 sniff 1
Password:
Capturing 802.11 frames on en1.
^CSession saved to /tmp/airportSniffndDZXh.cap.
David-Maynors-MacBook-Pro:~ dave$

The downside is that while sniffing you wireless card cannot be used for normal operations. If this is common knowledge 
I apologize, I find it interesting Apple choose to include this ability by default. 

On Apr 13, 2010, at 12:27 PM, KF (lists) wrote:

> Pre Snow Leopard versions of OSX work fine with kismet.
> -KF
>
> Sent from my iPad
>
> On Apr 13, 2010, at 11:10 AM, Cody Robertson <cody () hawkhost com> wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 4/13/10 10:41 AM, Justin Chang wrote:
> > > Hello group
> > > What are some of the best wireless sniffers on MAC OS X platform? I want to be able to sniff the traffic and look 
> > > for sensitive information. The company has a small budget so both free and commercial are fine
> > > Thanks                                        
> > >
> > >
> > >
> > > _______________________________________________
> > > Full-Disclosure - We believe in it.
> > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > > Hosted and sponsored by Secunia - http://secunia.com/
> > Wireshark should work.
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.9 (Darwin)
> > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> >
> > iEYEARECAAYFAkvEiVoACgkQAr2PPaFwRupcvACaA5iBD/mxrEJ8xODwNr/6vLhO
> > MHkAn1/j740oDaQHueGgapfP6Off5rmW
> > =t1Bb
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/