> ## Documentation Index
> Fetch the complete documentation index at: https://docs.intuitibits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# About packet captures

> Overview of packet captures in Airtool 2.

*Airtool 2* can capture Wi-Fi traffic on single or multiple channels using the built-in Wi-Fi adapter. It can also perform remote Wi-Fi captures using a *sensor* and capture other protocols such as Zigbee and Bluetooth Low Energy (BLE) using a compatible USB dongle.

When capturing Wi-Fi traffic using the built-in Wi-Fi adapter, *Airtool 2* will disconnect the adapter from the network as it needs to put the adapter into *monitor mode*. *Monitor mode* is an operation mode where the adapter passes all of the Wi-Fi frames to *Airtool 2* instead of only those frames intended for the host computer, allowing *Airtool 2* to *sniff* the over-the-air traffic.

<Note>
  Because macOS does not provide third-party apps with an official mechanism to manage the adapter, *Airtool 2* attempts to reconnect to the previous network by power-cycling the adapter. Your Mac may instead connect to a different preferred network or may not reconnect.
</Note>

When you stop the capture, *Airtool 2* will automatically open the capture file using the default application for handling capture files if there's one installed (e.g., [Wireshark](https://www.wireshark.org)). You can change this behavior by going to the *Airtool 2* menu bar extra > *Settings* > *General* and choosing a different option under *After saving capture file*, such as opening the file in a different application that can read *pcapng* format, or doing nothing at all.

***

## Capture metadata

*Airtool 2* embeds a summary of the capture configuration as a comment in the *pcapng* file. Most packet analyzers can display it; in Wireshark, go to *Statistics* > *Capture File Properties*.

The comment typically includes the capture source (e.g., the built-in Wi-Fi adapter, a sensor, or another connected device), the interface used, and the channel, band, and channel width. For example:

```
Device: Built-in Wi-Fi
Interface: en0, Channel: 6 (2.4 GHz, 20 MHz)
```

For multiple channel captures, the comment lists the channels and dwell time instead of a single channel. For multi-source captures, it lists the device, interface, and channel for each source. It also notes any active capture options that affect how the file was recorded, such as [frame slicing](/airtool2/use-automatic-frame-slicing) or a capture file size limit.

***

## Notifications

After terminating the capture, *Airtool 2* will show a notification with the capture details, including filename, size, and the number of frames. You can click the notification to reveal the capture file in *Finder*. If the capture was uploaded to a cloud service, you can click the notification to launch a browser and automatically open the capture in the cloud service's dashboard.

<Note>
  If you've configured *Airtool 2* to launch the capture in an external application, the notification only includes the size and number of frames forwarded to the external application.
</Note>

To disable notifications, go to the *Airtool 2* menu bar extra > *Settings* > *General* and clear **Show capture complete notification**.

## See also

* [Capture on a single or multiple channels](/airtool2/capture-using-the-built-in-wifi-adapter)
* [Capture on multiple channels and sensors](/airtool2/capture-on-multiple-channels-and-sensors)
* [Do live captures with Wireshark](/airtool2/do-live-captures-with-wireshark)
* [Change General settings](/airtool2/general-settings)