2️⃣ Airtool 2
Last updated
Last updated
Airtool 2 is an inexpensive packet capture tool for macOS. It is available with a 3-day free trial for those who may not own a copy.
Airtool 2 can use two sources for capturing frames over the air:
the internal wireless NIC of the Mac
a remote sensor capture device such as the WLAN Pi
Airtool 2 also makes it possible to perform affordable, multichannel captures using multiple remote sensors and Wi-Fi adapters. In our lab, we'll be using Airtool 2 with the WLAN Pi M4 as its remote sensor:
Verify Airtool 2 is running in your menu bar (Wi-Fi icon with a wrench spanner)
Click on the Airtool 2 icon and choose Preferences:\
Ensure that "Launch capture in:" option has Wireshark selected:
Airtool 2 can perform remote captures by using SSH to connect from your Mac to the remote capture device (i.e., the WLAN Pi).
When Airtool 2 connects to the device using SSH, it remotely executes a series of commands to capture Wi-Fi traffic. The commands perform the following actions:
drop the device's Wi-Fi adapter (e.g. wlan0) into monitor mode
set the desired channel and channel width
run tcpdump to capture and send the Wi-Fi frames back over to Airtool 2 via the SSH connection.
Airtool 2 uses the WLAN Pi's wireless adapter (wlan0) to capture frames over the air. The frames are returned from the WLAN Pi to your Mac over an IP connection to the Ethernet port of the WLAN Pi.
Note: It's also possible to add a second wireless adapter to connect to the WLAN Pi if an Ethernet connection is unavailable. This would require a USB wireless adapter plugged into the WLAN Pi M4. If using this option, remember that the connection for the second wireless interface must not be the same as the capture channel. We will not be using this method in our lab work.
All Airtool 2 features (automatic frame slicing, capture size limits, file rotation, live captures, etc.) are available using a remote sensor in the same way as when capturing using the built-in Wi-Fi adapter.
To capture with a remote sensor, go to Preferences > Sensors and add a new sensor. You will need the hostname or IP address of the sensor. If the sensor is not configured to use the standard SSH port (TCP port 22), then you need to specify the correct port number in the Port field.
To start a capture using a remote sensor, choose the sensor from the Airtool 2 menu. A pop-up similar to the screenshot below will appear so details like capture interface, channel, and channel width can be selected.
Before the capture starts, you will be prompted to enter to select the channel and the channel width. The wireless interface will be automatically selected (usually wlan0), unless you enter a specific interface name (e.g., wlan1).
The remote wireless interface may not support some channels and channel widths. If the selected channel and channel width combination is not supported, the capture will fail, and you may choose to change the capture options and try again.
The first time you capture from the remote sensor, you will be prompted to authenticate using the remote device's SSH username and password. You can choose to have Airtool 2 remember the credentials, so you don't have to enter them every time you do a capture. Airtool 2 will store the credentials securely in your Mac's keychain.
To manage the sensors, go to Preferences > Sensors. You can add, edit or delete existing sensors, mark sensors as favourite, and change the sensors' order by dragging the entries in the list.
If you mark the sensor as favourite, Airtool 2 will list the sensor in the main menu for quicker access.
More details can be found in Airtool 2's User Manual.
Now that you've completed the setup of Airtool 2, move onto to the macOS Capture lab to take a closer look at some real-world Wi-Fi frames.
Airtool 2 discovers WLAN Pi-based remote sensors deployed in your local area network automatically, so don't be surprised if you WLAN Pi is already in the list
