> ## Documentation Index
> Fetch the complete documentation index at: https://docs.intuitibits.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Capture using a sensor

> Perform remote Wi-Fi captures using a sensor in Airtool 2.

*Airtool 2* can be used to perform remote or external Wi-Fi traffic captures using a capable Linux box with a suitable Wi-Fi adapter, such as the [WLAN Pi](http://www.wlanpi.com).

Sensor captures are done by using *SSH* to connect to the sensor. When *Airtool 2* connects to the sensor using *SSH*, it executes a series of commands to capture Wi-Fi traffic. These commands put the sensor's Wi-Fi adapter (e.g., `wlan0`) into *monitor mode*, set the desired channel and channel width, and then run [`tcpdump`](https://www.tcpdump.org) to start a capture and send the Wi-Fi frames back over to *Airtool 2* via the *SSH* connection.

<Note>
  Because *Airtool 2* will use the sensor's main Wi-Fi adapter for capturing, *Airtool 2* needs to connect to the sensor using a wired connection or a secondary Wi-Fi adapter.
</Note>

<Warning>
  If using a secondary Wi-Fi adapter, make sure the channel you will be capturing on is not the same as the channel the secondary Wi-Fi adapter is using.
</Warning>

All *Airtool 2* features—including automatic frame slicing, capture size limits, file rotation, and live captures—are fully supported when using a *sensor*, just as they are with the built-in Wi-Fi adapter.

***

## Building a sensor

A sensor is just a Linux box configured to allow for remote execution of specific commands to perform traffic captures using a suitable Wi-Fi adapter.

To use a Linux box as a *sensor* in *Airtool 2*, you must ensure the sensor allows SSH access using username and password authentication. Passwordless authentication is not supported at the moment.

You will also need a Wi-Fi adapter that supports *monitor mode*. *Airtool 2* will automatically choose the first wireless interface to do the capture, but you can also specify the name of the interface you wish to use when starting the capture.

<Tip>
  The [WLAN Pi](http://www.wlanpi.com) comes pre-configured to work as a *sensor* for *Airtool 2*.
</Tip>

### Install the required utilities

For a Linux box to work as a sensor, the following utilities must be installed:

| Utility         | Used for                                                        |
| --------------- | --------------------------------------------------------------- |
| `ip` (iproute2) | Configuring the Wi-Fi interface                                 |
| `iw`            | Putting the interface in *monitor mode* and setting the channel |
| `tcpdump`       | Capturing Wi-Fi traffic                                         |

### Configure passwordless sudo

*Airtool 2* runs the utilities listed above over SSH with `sudo`, so the SSH user you use to connect to the sensor must be able to run them **without being prompted for a password**. You can grant that permission to only those utilities by adding a file to the `/etc/sudoers.d/` directory on the sensor:

1. Find the absolute path of each utility. Paths vary between Linux distributions, so check them on the sensor itself rather than assuming the ones used in the example below:

   ```bash theme={null}
   command -v ip iw tcpdump
   ```

2. Create the sudoers file, called `wlandump` in this example, using `visudo`, which checks the syntax before saving:

   ```bash theme={null}
   sudo visudo -f /etc/sudoers.d/wlandump
   ```

3. Add a single line listing the utilities, using the paths you found in step 1:

   ```text theme={null}
   %sudo ALL=(ALL) NOPASSWD: /sbin/iw, /bin/ip, /usr/bin/tcpdump
   ```

   The paths above are examples. `sudo` matches each rule against the exact path of the command it runs, so if a utility is installed elsewhere on your sensor, replace the example path with the one you found in step 1.

4. Save the file and exit the editor, then make the file read-only:

   ```bash theme={null}
   sudo chmod -w /etc/sudoers.d/wlandump
   ```

5. Verify the configuration by logging in to the sensor as the SSH user and running a utility with `sudo -n`, which fails instead of prompting for a password:

   ```bash theme={null}
   sudo -n iw dev
   ```

   If the command lists the wireless interfaces, the SSH user can run the utilities without entering a password. If it returns "sudo: a password is required", check the paths you entered in step 3 and the group membership described below.

<Note>
  The example line grants passwordless `sudo` to every member of the `sudo` group (`%sudo`). If the SSH user doesn't belong to that group, replace `%sudo` with the username, as in `wlanpi ALL=(ALL) NOPASSWD: /sbin/iw, /bin/ip, /usr/bin/tcpdump`.
</Note>

<Warning>
  A syntax error in a file under `/etc/sudoers.d/` can prevent `sudo` from working on the sensor. Edit these files with `visudo`, which refuses to save a file that contains invalid syntax.
</Warning>

***

## Using a sensor

To use a *sensor*, go to the *Airtool 2* menu bar extra > *Settings* > *Sensors* and add a new sensor. You will need the hostname or IP address of the sensor. If the sensor is not configured to use the standard SSH port (TCP port 22), specify the correct port number in the **Port** field. Then choose the sensor from the *Airtool 2* menu to start the capture.

<Tip>
  *Airtool 2* discovers [WLAN Pi](http://www.wlanpi.com)-based sensors deployed in your local area network automatically.
</Tip>

Before the capture starts, you will be prompted to enter the name of the wireless interface you wish to capture on remotely (e.g., `wlan0`) and to select the channel and the channel width. If you don't provide an interface name, *Airtool 2* will automatically choose the first wireless interface to do the capture.

<Note>
  The remote wireless interface may not support some channels and channel widths. If the selected channel and channel width combination is not supported, the capture will fail, and you may choose to change the capture options and try again.
</Note>

The first time you capture from the *sensor*, you will be prompted to authenticate using the sensor's SSH username and password. You can choose to have *Airtool 2* remember the credentials, so you don't have to enter them every time you do a capture. *Airtool 2* will store the credentials securely in your Mac's keychain.

***

## Managing sensors

To manage the sensors, go to the *Airtool 2* menu bar extra > *Settings* > *Sensors*. You can add, edit or delete existing sensors, mark sensors as *favorite*, and change the sensors' order by dragging the entries in the list.

<Tip>
  If you mark the sensor as *favorite*, *Airtool 2* will list the sensor in the main menu for quicker access.
</Tip>

You can also import or export sensors in JSON format, or run diagnostics on a sensor, by clicking the **More** button.

## See also

* [Do live captures with Wireshark](/airtool2/do-live-captures-with-wireshark)
* [Use automatic frame slicing](/airtool2/use-automatic-frame-slicing)
* [Change Sensors settings](/airtool2/sensors-settings)