Skip to main content
Airtool 2 can capture Wi-Fi traffic on single or multiple channels using the built-in Wi-Fi adapter. It can also perform remote Wi-Fi captures using a sensor and capture other protocols such as Zigbee and Bluetooth Low Energy (BLE) using a compatible USB dongle. When capturing Wi-Fi traffic using the built-in Wi-Fi adapter, Airtool 2 will disconnect the adapter from the network as it needs to put the adapter into monitor mode. Monitor mode is an operation mode where the adapter passes all of the Wi-Fi frames to Airtool 2 instead of only those frames intended for the host computer, allowing Airtool 2 to sniff the over-the-air traffic.
Because macOS does not provide third-party apps with an official mechanism to manage the adapter, Airtool 2 attempts to reconnect to the previous network by power-cycling the adapter. Your Mac may instead connect to a different preferred network or may not reconnect.
When you stop the capture, Airtool 2 will automatically open the capture file using the default application for handling capture files if there’s one installed (e.g., Wireshark). You can change this behavior by going to the Airtool 2 menu bar extra > Settings > General and choosing a different option under After saving capture file, such as opening the file in a different application that can read pcapng format, or doing nothing at all.

​
Capture metadata

Airtool 2 embeds a summary of the capture configuration as a comment in the pcapng file. Most packet analyzers can display it; in Wireshark, go to Statistics > Capture File Properties. The comment typically includes the capture source (e.g., the built-in Wi-Fi adapter, a sensor, or another connected device), the interface used, and the channel, band, and channel width. For example:
For multiple channel captures, the comment lists the channels and dwell time instead of a single channel. For multi-source captures, it lists the device, interface, and channel for each source. It also notes any active capture options that affect how the file was recorded, such as frame slicing or a capture file size limit.

​
Notifications

After terminating the capture, Airtool 2 will show a notification with the capture details, including filename, size, and the number of frames. You can click the notification to reveal the capture file in Finder. If the capture was uploaded to a cloud service, you can click the notification to launch a browser and automatically open the capture in the cloud service’s dashboard.
If you’ve configured Airtool 2 to launch the capture in an external application, the notification only includes the size and number of frames forwarded to the external application.
To disable notifications, go to the Airtool 2 menu bar extra > Settings > General and clear Show capture complete notification.

​
See also