MacBook Pro 抓取WiFi 空口log(sniffer/air log)

发布时间 2023-11-13 16:48:30作者: petercao


打开wifi

打开自带的无线网络诊断 wireless diagnostics (可以直接搜索无线诊断)

打开嗅探器sniffer

设置频段 带宽

https://osxdaily.com/2015/04/23/sniff-packet-capture-packet-trace-mac-os-x-wireless-diagnostics/

 

How to Sniff Packets with Wireless Diagnostics in OS X

This process will automatically disconnect from any active wireless network and transmission on the Mac, instead dedicating the Macs wi-fi card to sniff wireless network traffic and to capture detected data into a packet transfer file.

    1. Option+Click on the Wi-Fi menu item in the OS X menu bar
    2. Choose “Open Wireless Diagnostics” from the list to open the wi-fi utility

Open the Wireless Diagnostics app in OS X

    1. Ignore the splash screen and pull down the “Window” menu, choose “Sniffer” from the list of options in the Wireless Diagnostics menu

Wireless Diagnostics Packet Sniffer in Mac OS X

    1. Select the Wi-Fi Channel and channel Width to sniff and capture packets for, using the wi-fi network stumbler tool can be helpful to identify which channels and widths to sniff network traffic for, then click “Start”

Start packet sniffing on channels to capture packets in Mac OS X

  1. When satisfied with the length of the packet capture, or when sufficient network traffic has been sniffed, click on “Stop” to end the packet trace and to save the captured packet file to the Desktop of OS X

The captured packet file will appear on the desktop with a .wcap extension and include the time of the packet capture, the name should look something like “2017.04.20_17-27-12-PDT.wcap”.

Captured packets WCAP and PCAP files from the Mac OS X packets sniffer

Opening the WCAP / PCAP Capture File in Mac OS X

This file can be viewed from the command line with tcpdump, or with an app like WireShark. Browsing the packet capture file through the command line will look like the following:

Reading a pcap file in Mac OS X command line

If you want to, you can change the file extension from wcap to pcap and you’ll be able to open the output file in other apps too, including Cocoa Packet Analyzer (App Store link) as well. The screen shot below shows what this looks like in the CPA app:

Reading a captured packet trace PCAP WCAP file in Mac OS X With Cocoa packet Analyzer app