Typorithm · medium

Wireless Recon (airodump)

wifi-reconpentestaircrack-ngmonitor-modeairodump

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Wireless Recon (airodump)

Wireless

The aircrack-ng suite is the standard Wi-Fi toolkit. airmon-ng puts the adapter into monitor mode, airodump-ng surveys access points and clients, then you lock onto one BSSID and channel to capture. Run this only against networks the client owns, with written consent.

Wireless recon starts by switching the adapter into monitor mode with airmon-ng start wlan0, which creates a wlan0mon interface that can passively observe 802.11 traffic rather than join a network.

Running airodump-ng wlan0mon lists every nearby access point and client — BSSID, channel, encryption, and signal — so you can identify the in-scope targets the client owns.

Once you know the target, you focus: airodump-ng -c 6 --bssid AA:BB:CC -w cap wlan0mon pins one channel and one BSSID and saves the capture to disk. Every wireless test runs only on networks the client owns, with written consent that scopes exactly which SSIDs and BSSIDs are in bounds.

airmon-ng start wlan0 enables monitor mode (wlan0mon).

airodump-ng surveys APs, channels, and clients.

-c and --bssid focus the capture on one in-scope AP.

airmon-ng start wlan0
airodump-ng wlan0mon
airodump-ng -c 6 --bssid AA:BB:CC -w cap wlan0mon
# survey APs, channels, and clients

Read the implementation

Connect each part of the code to the concept before you type.

1. Enable monitor mode

airmon-ng start wlan0 puts the adapter into monitor mode, creating wlan0mon so it can passively observe nearby traffic.

airmon-ng start wlan0

2. Survey the air

airodump-ng on the monitor interface lists every access point and client it sees, with BSSIDs, channels, and signal strength.

airodump-ng wlan0mon

3. Focus and capture

Locking to one channel (-c 6) and BSSID and writing to a file (-w cap) captures only the client-owned AP you are authorized to test.

airodump-ng -c 6 --bssid AA:BB:CC -w cap wlan0mon

4. Recon goal

The recon phase maps the target's own access points, their channels, and connected clients before any active step.

# survey APs, channels, and clients

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.