Airodump

Airodump-ng
Airodump-ng is used for packet capturing of raw 802.11 frames and is particularly suitable for collecting WEP IVs (Initialization Vector) for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points.
Additionally, airodump-ng writes out several files containing the details of all access points and clients seen.
Usage
Before running airodump-ng, you may start the airmon-ng script to list the detected wireless interfaces. It is possible, but not recommended, to run Kismet and airodump-ng at the same time.
usage: airodump-ng <options> <interface>[,<interface>,...]

Options:
    --ivs               : Save only captured IVs
    --gpsd              : Use GPSd
    --write    <prefix> : Dump file prefix
    -w                  : same as --write
    --beacons           : Record all beacons in dump file
    --update     <secs> : Display update delay in seconds
    --showack           : Prints ack/cts/rts statistics
    -h                  : Hides known stations for --showack
    -f          <msecs> : Time in ms between hopping channels
    --berlin     <secs> : Time before removing the AP/client
                          from the screen when no more packets
                          are received (Default: 120 seconds)
    -r           <file> : Read packets from that file
    -x          <msecs> : Active Scanning Simulation
    --output-format
              <formats> : Output format. Possible values:
                          pcap, ivs, csv, gps, kismet, netxml
                          Short format "-o"
                          The option can be specified multiple times.  In this case, each file format
                          specified will be output.  Only ivs or pcap can be used, not both. 
Filter options:
    --encrypt   <suite> : Filter APs by cipher suite
    --netmask <netmask> : Filter APs by mask
    --bssid     <bssid> : Filter APs by BSSID
    -a                  : Filter unassociated clients

By default, airodump-ng hop on 2.4Ghz channels.
You can make it capture on other/specific channel(s) by using:
    --channel <channels>: Capture on specific channels
    --band <abg>        : Band on which airodump-ng should hop
    -C    <frequencies> : Uses these frequencies in MHz to hop
    --cswitch  <method> : Set channel switching method
                  0     : FIFO (default)
                  1     : Round Robin
                  2     : Hop on last
    -s                  : same as --cswitch

    --help              : Displays this usage screen

Usage Tips
What's the meaning of the fields displayed by airodump-ng ?

Airodump-ng will display a list of detected access points, and also a list of connected clients (“stations”). Here's an example screenshot:
 CH  9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ WPA handshake: 00:14:6C:7E:40:80
                                                                                                           
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
                                                                                                           
 00:09:5B:1C:AA:1D   11  16       10        0    0  11  54.  OPN              NETGEAR                        
 00:14:6C:7A:41:81   34 100       57       14    1   9  11e  WEP  WEP         bigbear
 00:14:6C:7E:40:80   32 100      752       73    2   9  54   WPA  TKIP   PSK  teddy                            
                                                                                                           
 BSSID              STATION            PWR   Rate   Lost  Packets  Probes
                               
 00:14:6C:7A:41:81  00:0F:B5:32:31:31   51   36-24    2       14
 (not associated)   00:14:A4:3F:8D:13   19    0-0     0        4    mossy
 00:14:6C:7A:41:81  00:0C:41:52:D1:D1   -1   36-36    0        5
 00:14:6C:7E:40:80  00:0F:B5:FD:FB:C2   35   54-54    0       99    teddy

The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. In the example above, “WPA handshake: 00:14:6C:7E:40:80” indicates that a WPA/WPA2 handshake was successfully captured for the BSSID.
In the example above the client rate of “36-24” means:
The first number is the last data rate from the AP (BSSID) to the Client (STATION). In this case 36 megabits per second.
The second number is the last data rate from Client (STATION) to the AP (BSSID). In this case 24 megabits per second.
These rates may potentially change on each packet transmission. It is simply the last speed seen.
These rates are only displayed when locked to a single channel, the AP/client transmission speeds are displayed as part of the clients listed at the bottom.
NOTE: APs need more then one packet to appear on the screen. APs with a single packet are not displayed.

Field    Description      
BSSID    MAC address of the access point. In the Client section, a BSSID of ”(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.      
PWR    Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal level reporting.      
RXQ    Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. See note below for a more detailed explanation.      
Beacons    Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.      
# Data    Number of captured data packets (if WEP, unique IV count), including data broadcast packets.      
#/s    Number of data packets per second measure over the last 10 seconds.      
CH    Channel number (taken from beacon packets).
Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference.      
MB    Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled.      
ENC    Encryption algorithm in use. OPN = no encryption,”WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP is present.      
CIPHER    The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.      
AUTH    The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).      
ESSID    Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests. See this section for more information concerning hidden ESSIDs.      
STATION    MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of ”(not associated)”.      
Lost    The number of data packets lost over the last 10 seconds based on the sequence number. See note below for a more detailed explanation.      
Packets    The number of data packets sent by the client.      
Probes    The ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected.    
NOTES:
RXQ expanded:
Its measured over all management and data frames. The received frames contain a sequence number which is added by the sending access point. RXQ = 100 means that all packets were received from the access point in numerical sequence and none were missing. That's the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP.
N.B.: RXQ column will only be shown if you are locked on a single channel, not channel hopping.
Lost expanded:
It means lost packets coming from the client. To determine the number of packets lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many packets you have lost.
Possible reasons for lost packets:
You cannot send (in case you are sending) and listen at the same time, so every time you send something you can't hear the packets being transmitted in that interval.
You are maybe losing packets due too high transmit power (you may be too close to the AP).
There is too much noise on the current channel (other APs, microwave oven, bluetooth…)
To minimize the number of lost packets, vary your physical position, type of antenna used, channel, data rate and/or injection rate.
Run aircrack-ng while capturing data
To speed up the cracking process, run aircrack-ng while you are running airodump-ng. You can capture and crack at the same time. Aircrack-ng will periodically reread the captured data so it is always working with all the available IVs.
Limiting Data Capture to a Single AP
To limit the data capture to a single AP you are interested in, include the ”- -bssid” option and specify the AP MAC address. For example: “airodump-ng -c 8 - -bssid 00:14:6C:7A:41:20 -w capture ath0”.
How to Minimize Disk Space for Captures
To minimize disk space used by the capture, include the ”- -ivs” option. For example: “airodump-ng -c 8 - -bssid 00:14:6C:7A:41:20 -w capture - -ivs ath0”. This only stores the initialization vectors and not the full packet. This cannot be used if you are trying to capture the WPA/WPA2 handshake or if you want to use PTW attack on WEP.
How to Select All APs Starting With Similar BSSIDs
Lets say, for example, you wish to capture packets for all Cisco-Linksys APs where the BSSID starts with “00:1C:10”.
You specify that starting bytes you wish to match with the ”-d” / ”–bssid” option and pad with zeroes to a full MAC. Then use ”-m” / ”–netmask” option to specify which part of the BSSID you wish to match via “F”s and pad with zeroes to a full MAC.
So since you want to match “00:1C:10”, you use “FF:FF:FF”.
 airodump-ng -d 00:1C:10:00:00:00 -m FF:FF:FF:00:00:00 wlan0
How to Select Specific Channels or a Single Channel
The ”–channel” (-c) option allows a single or specific channels to be selected.
Example of a single channel:
 airodump-ng -c 11 wlan0
For cards which needs to be reset when on a single channel:
 airodump-ng -c 11,11 wlan0
Example of selected channels:
 airodump-ng -c 1,6,11 wlan0
Text Files Containing Access Points and Clients
Each time airodump-ng is run with the option to write IVs or full packets, a few text files are also generated and written to disk. They have the same name and a suffix of ”.csv” (CSV file), ”.kismet.csv” (Kismet CSV file) and ”.kismet.netxml” (Kismet newcore netxml file).
The CSV file contains the details of all access points and clients seen. See kismet documentation for more details about the kismet CSV and netxml.
Here is an example:
 BSSID, First time seen, Last time seen, channel, Speed, Privacy, Cipher, Authentication, Power, # beacons, # IV , LAN IP, ID-length, ESSID, Key
 00:1C:10:26:22:41, 2007-10-07 12:48:58, 2007-10-07 12:49:44,  6,  48, WEP , WEP,   , 171,      301,        0, 0.  0.  0.  0,   5, zwang,
 00:1A:70:51:B5:71, 2007-10-07 12:48:58, 2007-10-07 12:49:44,  6,  48, WEP , WEP,   , 175,      257,        1, 0.  0.  0.  0,   9, brucey123,
 00:09:5B:7C:AA:CA, 2007-10-07 12:48:58, 2007-10-07 12:49:44, 11,  54, OPN ,    ,   , 189,      212,        0,   0.  0.  0.  0,   7, NETGEAR,

 Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs
 00:1B:77:7F:67:94, 2007-10-07 12:49:43, 2007-10-07 12:49:43, 178,        3, (not associated) ,
Usage Troubleshooting
I am getting no APs or clients shown
If you have a laptop with a builtin wireless card, ensure it is “turned on / enabled” in the bios
Does your card works in managed mode? If not, the problem is not with airodump-ng. You need to get this working first.
See if this madwifi-ng web page has information that may be helpful.
Although it is not very “scientific”, sometimes simply unloading then reloading the driver will get it working. This is done with the rmmod and modprobe commands.
Also see the next troubleshooting tip.
I am getting little or no data
Make sure you used the ”-c” or ”- -channel” option to specify a single channel. Otherwise, by default, airodump-ng will hop between channels.
You might need to be physically closer to the AP to get a quality signal.
Make sure you have started your card in monitor mode with airmon-ng (Linux only).
Note for madwifi-ng
Make sure there are no other VAPs running. There can be issues when creating a new VAP in monitor mode and there was an existing VAP in managed mode.
You should first stop ath0 then start wifi0:
 airmon-ng stop ath0
 airmon-ng start wifi0
or
 wlanconfig ath0 destroy
 wlanconfig ath create wlandev wifi0 wlanmode monitor
Airodump-ng keeps switching between WEP and WPA
This is happening because your driver doesn't discard corrupted packets (that have an invalid CRC). If it's a ipw2100 (Centrino b), it just can't be helped; go buy a better card. If it's a Prism2, try upgrading the firmware.
Airodump-ng stops capturing data after a short period of time
The most common cause is that a connection manager is running on your system and takes the card out of monitor mode. Be sure to stop all connection managers prior to using the aircrack-ng suite. In general, disabling “Wireless” in your network manager should be enough but sometimes you have to stop them completely. It can be done with airmon-ng:
airmon-ng check kill
Recent linux distributions use upstart; it automatically restarts the network manager. In order to stop it, see the following entry.
As well, make sure that wpa_supplicant is not running. Another potential cause is the PC going to sleep due to power saving options. Check your power saving options.
The madwifi-ng driver for the atheros chipset contains a bug in releases up to r2830 which causes airodump-ng in channel hopping mode to stop capturing data after a few minutes. The fix is to use r2834 or above of the madwifi-ng drivers.
See also this entry for recent