Skip to main content
Airtool 2 can be used to perform remote or external Wi-Fi traffic captures using a capable Linux box with a suitable Wi-Fi adapter, such as the WLAN Pi. Sensor captures are done by using SSH to connect to the sensor. When Airtool 2 connects to the sensor using SSH, it executes a series of commands to capture Wi-Fi traffic. These commands put the sensor’s Wi-Fi adapter (e.g., wlan0) into monitor mode, set the desired channel and channel width, and then run tcpdump to start a capture and send the Wi-Fi frames back over to Airtool 2 via the SSH connection.
Because Airtool 2 will use the sensor’s main Wi-Fi adapter for capturing, Airtool 2 needs to connect to the sensor using a wired connection or a secondary Wi-Fi adapter.
If using a secondary Wi-Fi adapter, make sure the channel you will be capturing on is not the same as the channel the secondary Wi-Fi adapter is using.
All Airtool 2 features—including automatic frame slicing, capture size limits, file rotation, and live captures—are fully supported when using a sensor, just as they are with the built-in Wi-Fi adapter.

​
Building a sensor

A sensor is just a Linux box configured to allow for remote execution of specific commands to perform traffic captures using a suitable Wi-Fi adapter. To use a Linux box as a sensor in Airtool 2, you must ensure the sensor allows SSH access using username and password authentication. Passwordless authentication is not supported at the moment. You will also need a Wi-Fi adapter that supports monitor mode. Airtool 2 will automatically choose the first wireless interface to do the capture, but you can also specify the name of the interface you wish to use when starting the capture.
The WLAN Pi comes pre-configured to work as a sensor for Airtool 2.

​
Install the required utilities

For a Linux box to work as a sensor, the following utilities must be installed:

​
Configure passwordless sudo

Airtool 2 runs the utilities listed above over SSH with sudo, so the SSH user you use to connect to the sensor must be able to run them without being prompted for a password. You can grant that permission to only those utilities by adding a file to the /etc/sudoers.d/ directory on the sensor:
  1. Find the absolute path of each utility. Paths vary between Linux distributions, so check them on the sensor itself rather than assuming the ones used in the example below:
  2. Create the sudoers file, called wlandump in this example, using visudo, which checks the syntax before saving:
  3. Add a single line listing the utilities, using the paths you found in step 1:
    The paths above are examples. sudo matches each rule against the exact path of the command it runs, so if a utility is installed elsewhere on your sensor, replace the example path with the one you found in step 1.
  4. Save the file and exit the editor, then make the file read-only:
  5. Verify the configuration by logging in to the sensor as the SSH user and running a utility with sudo -n, which fails instead of prompting for a password:
    If the command lists the wireless interfaces, the SSH user can run the utilities without entering a password. If it returns “sudo: a password is required”, check the paths you entered in step 3 and the group membership described below.
The example line grants passwordless sudo to every member of the sudo group (%sudo). If the SSH user doesn’t belong to that group, replace %sudo with the username, as in wlanpi ALL=(ALL) NOPASSWD: /sbin/iw, /bin/ip, /usr/bin/tcpdump.
A syntax error in a file under /etc/sudoers.d/ can prevent sudo from working on the sensor. Edit these files with visudo, which refuses to save a file that contains invalid syntax.

​
Using a sensor

To use a sensor, go to the Airtool 2 menu bar extra > Settings > Sensors and add a new sensor. You will need the hostname or IP address of the sensor. If the sensor is not configured to use the standard SSH port (TCP port 22), specify the correct port number in the Port field. Then choose the sensor from the Airtool 2 menu to start the capture.
Airtool 2 discovers WLAN Pi-based sensors deployed in your local area network automatically.
Before the capture starts, you will be prompted to enter the name of the wireless interface you wish to capture on remotely (e.g., wlan0) and to select the channel and the channel width. If you don’t provide an interface name, Airtool 2 will automatically choose the first wireless interface to do the capture.
The remote wireless interface may not support some channels and channel widths. If the selected channel and channel width combination is not supported, the capture will fail, and you may choose to change the capture options and try again.
The first time you capture from the sensor, you will be prompted to authenticate using the sensor’s SSH username and password. You can choose to have Airtool 2 remember the credentials, so you don’t have to enter them every time you do a capture. Airtool 2 will store the credentials securely in your Mac’s keychain.

​
Managing sensors

To manage the sensors, go to the Airtool 2 menu bar extra > Settings > Sensors. You can add, edit or delete existing sensors, mark sensors as favorite, and change the sensors’ order by dragging the entries in the list.
If you mark the sensor as favorite, Airtool 2 will list the sensor in the main menu for quicker access.
You can also import or export sensors in JSON format, or run diagnostics on a sensor, by clicking the More button.

​
See also