1WIFIDUMP(1) WIFIDUMP(1)
2
6 wifidump - Provides an interface to capture Wi-Fi frames from a remote
7 host through SSH.
8
10 wifidump [ --help ] [ --version ] [ --extcap-interfaces ]
11 [ --extcap-dlts ] [ --extcap-interface=<interface> ]
12 [ --extcap-config ] [ --extcap-capture-filter=<capture filter> ]
13 [ --capture ] [ --fifo=<path to file or pipe> ]
14 [ --remote-host=<IP address> ] [ --remote-port=<TCP port> ]
15 [ --remote-username=<username> ] [ --remote-password=<password> ]
16 [ --sshkey=<public key path> ] [ --remote-interface=<interface> ]
17 [ --remote-channel-frequency=<channel frequency> ]
18 [ --remote-channel-width=<channel width> ]
19 wifidump --extcap-interfaces
21 wifidump --extcap-interface=<interface> --extcap-dlts
23 wifidump --extcap-interface=<interface> --extcap-config
25 wifidump --extcap-interface=<interface> --fifo=<path to file or pipe>
27 --capture --remote-host=myremotehost --remote-port=22
28 --remote-username=user --remote-interface=eth2
29 --remote-channel-frequency=5180 --remote-channel-width=40
30
32 Wifidump is an extcap tool that allows you to capture Wi-Fi traffic
33 from a remote host over an SSH connection using tcpdump. The
34 requirement to capture Wi-Fi frames is that the remote host must have
35 the necessary binaries to manage and put the wanted interface into
36 monitor mode. Such binaries include: ip, iw, and iwconfig. Also,
37 because using monitor mode and managing the Wi-Fi interface requires
38 root privileges, the system must be configured to allow the wanted user
39 to run these binaries using sudo without entering a password.
40 Typically wifidump is not invoked directly. Instead it can be
42 configured through the Wireshark graphical user interface or its
43 command line. The following will start Wireshark and start capturing
44 from host remotehost:
45 $ wireshark '-oextcap.wifidump.remotehost:remotehost' -i wifidump -k
47 To explicitly control the remote capture command:
49 $ wireshark '-oextcap.wifidump.remotehost:remotehost' \
51 '-oextcap.wifidump.remotechannelfrequency:5180' \
52 '-oextcap.wifidump.remotechannelwidth:40' \
53 -i wifidump -k
54 Supported interfaces:
56 1. wifidump
58
60 --help
61 Print program arguments.
63 --version
65 Print program version.
67 --extcap-interfaces
69 List available interfaces.
71 --extcap-interface=<interface>
73 Use specified interfaces.
75 --extcap-dlts
77 List DLTs of specified interface.
79 --extcap-config
81 List configuration options of specified interface.
83 --capture
85 Start capturing from specified interface and write raw packet data
87 to the location specified by --fifo.
88 --fifo=<path to file or pipe>
90 Save captured packet to file or send it through pipe.
92 --remote-host=<remote host>
94 The address of the remote host for capture.
96 --remote-port=<remote port>
98 The SSH port of the remote host.
100 --remote-username=<username>
102 The username for ssh authentication.
104 --remote-password=<password>
106 The password to use (if not ssh-agent and pubkey are used).
108 WARNING: the passwords are stored in plaintext and visible to all
109 users on this system. It is recommended to use keyfiles with a SSH
110 agent.
111 --sshkey=<SSH private key path>
113 The path to a private key for authentication.
115 --remote-interface=<remote interface>
117 The remote network interface to capture from.
119 --remote-channel-frequency=<channel frequency>
121 The remote channel frequency in MHz.
123 --remote-channel-width=<channel width>
125 The remote channel width in MHz.
127 --extcap-capture-filter=<capture filter>
129 The capture filter. It corresponds to the value provided via the
131 tshark -f option, and the Capture Filter field next to the
132 interfaces list in the Wireshark interface.
133
135 To see program arguments:
136 wifidump --help
138 To see program version:
140 wifidump --version
142 To see interfaces:
144 wifidump --extcap-interfaces
146 Only one interface (wifidump) is supported.
148 Example output
150 interface {value=wifidump}{display=Wi-Fi remote capture}
152 To see interface DLTs:
154 wifidump --extcap-interface=wifidump --extcap-dlts
156 Example output
158 dlt {number=147}{name=wifidump}{display=Remote capture dependent DLT}
160 To see interface configuration options:
162 wifidump --extcap-interface=wifidump --extcap-config
164 Example output
166 arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}
168 {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
169 arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}
170 {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
171 arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}
172 {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
173 arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}
174 {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
175 arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}
176 {tooltip=The path on the local filesystem of the private ssh key}{mustexist=true}{group=Authentication}
177 arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}
178 {tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
179 arg {number=6}{call=--remote-interface}{display=Remote interface}{type=string}
180 {tooltip=The remote network interface used to capture}{default=auto}{group=Capture}
181 arg {number=7}{call=--remote-channel-frequency}{display=Remote channel}{type=selector}
182 {tooltip=The remote channel used to capture}{group=Capture}
183 arg {number=8}{call=--remote-channel-width}{display=Remote channel width}{type=selector}
184 {tooltip=The remote channel width used to capture}{group=Capture}
185 arg {number=9}{call=--remote-filter}{display=Remote capture filter}{type=string}
186 {tooltip=The remote capture filter}{group=Capture}
187 arg {number=10}{call=--remote-count}{display=Packets to capture}{type=unsigned}
188 {tooltip=The number of remote packets to capture.}{group=Capture}
189 arg {number=11}{call=--log-level}{display=Set the log level}{type=selector}
190 {tooltip=Set the log level}{required=false}{group=Debug}
191 arg {number=12}{call=--log-file}{display=Use a file for logging}{type=fileselect}
192 {tooltip=Set a file where log messages are written}{required=false}{group=Debug}
193 To capture:
195 wifidump --extcap-interface=wifidump --fifo=/tmp/wifidump.pcap --capture --remote-host 192.168.1.10 --remote-username user --remote-channel-frequency 5180 --remote-channel-width 40
197 Note
199 To stop capturing CTRL+C/kill/terminate application.
200 The wifidump binary can be renamed to support multiple instances. For
202 instance if we want wifidump to show up twice in wireshark (for
203 instance to handle multiple profiles), we can copy wifidump to
204 wifidump-host1 and wifidump-host2. Each binary will show up an
205 interface name same as the executable name. Those executables not being
206 "wifidump" will show up as "custom version" in the interface
207 description.
208
210 wireshark(1), tshark(1), extcap(4), tcpdump(1)
211
213 Wifidump is part of the Wireshark distribution. The latest version of
214 Wireshark can be found at https://www.wireshark.org.
215 HTML versions of the Wireshark project man pages are available at
217 https://www.wireshark.org/docs/man-pages.
218
220 Original Author
221 Adrian Granados <adrian[AT]intuitibits.com>
222 2022-12-08 WIFIDUMP(1)