Just as Nmap is the standard for wired networks, airodump-ng is the equivalent standard for the Wi-Fi world — part of the well-known aircrack-ng suite, letting you see nearby wireless networks, identify which devices are connected to each, and capture the traffic needed to assess password security.
Important: this tutorial should only be run against your own Wi-Fi network or a network you have explicit authorization to test — like a personal lab or a formal penetration-testing engagement. Monitoring or attempting to access someone else's Wi-Fi network without permission is a crime.
Prerequisite: a Wi-Fi adapter that supports monitor mode
Unlike most regular laptop Wi-Fi cards, airodump-ng needs a USB Wi-Fi adapter that supports monitor mode and packet injection (like the well-known Atheros or Ralink chipsets) — the same type of adapter covered in my wireless penetration-testing tutorials.
Step 1: Install the aircrack-ng suite
sudo apt install aircrack-ng
Step 2: Enable monitor mode
First, make sure no process (like NetworkManager) is interfering with the Wi-Fi card:
sudo airmon-ng check kill
Then put the Wi-Fi card into monitor mode:
sudo airmon-ng start wlan0
After this, a new interface named wlan0mon is usually created — this is the interface you'll use from here on.
Step 3: Monitor all nearby networks
sudo airodump-ng wlan0mon
This shows a live list of every Wi-Fi network in range — including the BSSID (the access point's MAC address), channel, encryption type (WEP, WPA, WPA2, WPA3), signal strength, and network name (ESSID). This is exactly the initial reconnaissance step, similar to what Nmap does for wired networks.
Step 4: Focus on one specific network (your own)
After finding your own network's BSSID and channel from the previous step's output, narrow monitoring to just that network:
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
-c specifies only channel 6 should be checked, --bssid targets only that access point, and -w capture means all captured packets get saved to files prefixed with capture.
Step 5: Viewing connected devices
In this same narrowed view, the bottom section also lists client devices (STATION) connected to that access point — exactly the information needed to see "which devices are currently connected to this network."
Step 6: Capturing the handshake
When a device connects to a WPA/WPA2 network, an encrypted exchange called a 4-way handshake takes place between the client and the access point. If, while airodump-ng is running against that network, one of the connected devices reconnects (e.g., after toggling a phone's Wi-Fi off and on), airodump-ng captures this exchange and displays a WPA handshake message at the top of the screen.
What exactly is this captured handshake used for?
The captured file (capture-01.cap) contains an encrypted version of the network's password, not the password itself. To check whether your own network's password is strong enough, you can test this file with the aircrack-ng tool and a wordlist — if your password is found within a few seconds, it means you should choose a more complex one; this simple evaluation is exactly what's recommended in my home Wi-Fi security tutorial.
Step 7: Restoring the card to normal mode
Once you're done, make sure to take the card out of monitor mode:
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager
Why should airodump-ng be part of your penetration-testing toolkit?
Wi-Fi security is one of the most common weak points in home networks and even many small enterprise networks. airodump-ng is exactly the tool that lets you actually test your own Wi-Fi password's strength with real numbers, before a real attacker does — exactly the kind of thing covered in my Wi-Fi security and wireless penetration testing courses.
Blog