The aircrack-ng Suite Explained

Introduction

The aircrack-ng suite is the de‑facto toolkit for authorized WPA2 security testing. It bundles four core utilities—airmon-ng, airodump-ng, aireplay-ng, and aircrack-ng—that together cover the entire testing lifecycle: enabling monitor mode, capturing traffic, injecting frames, and finally cracking the pre‑shared key. This article walks through each component, shows how they interlock, and demonstrates a practical workflow that complies with EU regulations. Keywords such as “aircrack-ng explained”, “aircrack-ng tutorial”, and “airmon-ng airodump-ng guide” are woven naturally into the text to help you find the guide when you need it.

Terminal window showing the aircrack-ng suite in action (Wikimedia Commons)

airmon-ng – enabling monitor mode

airmon-ng is the entry point for any wireless audit. It detects compatible network interfaces, kills interfering processes, and switches the selected NIC into monitor mode. Monitor mode is essential because it allows the NIC to receive every 802.11 frame on the chosen channel, not just those addressed to it.

Typical usage on a Linux host looks like this:

# List interfaces
airmon-ng

# Enable monitor mode on wlan0
airmon-ng start wlan0

# Verify the new interface (usually wlan0mon)
iwconfig wlan0mon

On newer kernels the tool may create wlan0 with the monitor flag instead of a separate wlan0mon. The --verbose flag prints detailed driver information, which is useful when troubleshooting hardware compatibility.

airodump-ng – packet capture

Once the NIC is in monitor mode, airodump-ng becomes the workhorse for gathering the data needed to crack a WPA2 network. It can display a live list of access points (APs), associated clients, signal strength, encryption type, and most importantly the four‑way handshake.

Key command‑line options:

• -c <channel> – lock the capture to a single channel, reducing noise.
• -w <prefix> – write captured packets to a .cap file for later analysis.
• --bssid <MAC> – focus on a specific AP, which is essential when multiple networks share the same channel.
• --write-interval <seconds> – rotate output files to avoid very large captures.

Example capture command:

# Capture on channel 6, focus on AP 00:11:22:33:44:55, write to capture file
airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture_001 wlan0mon

The output file capture_001-01.cap will contain all frames seen on that channel, including the crucial 4‑way handshake when a client connects or reconnects.

Diagram of the WPA2 4‑way handshake that aircrack-ng attempts to crack (Wikimedia Commons)

aireplay-ng – packet injection and deauth

Capturing a handshake can be as simple as waiting for a client to naturally reconnect, but in a controlled test you often want to force that event. aireplay-ng provides several injection modes, the most common being deauth (deauthentication) and fakeauth (fake authentication).

Deauthentication forces a client to disconnect from the AP, after which the client will automatically try to re‑associate, generating a fresh handshake. The basic syntax is:

# Deauth all clients on the target AP
aireplay-ng -0 10 -a 00:11:22:33:44:55 -c FF:FF:FF:FF:FF:FF wlan0mon

Parameters explained:

• -0 – deauth attack mode.
• 10 – number of deauth frames to send.
• -a – MAC address of the target AP.
• -c – MAC address of the client; FF:FF:FF:FF:FF:FF targets all clients.

EU compliance note: In the European Union the BLEShark Nano ships with deauth disabled by default. The device can still perform passive handshake capture, which satisfies most audit requirements while staying within legal boundaries.

aircrack-ng – password cracking

With a valid .cap file that contains a complete handshake, aircrack-ng attempts to recover the pre‑shared key (PSK). The tool supports several attack modes:

• Dictionary attack – tries each word from a wordlist.
• Brute‑force – iterates over all possible character combinations within a defined keyspace.
• Hybrid attack – combines dictionary entries with common mutations (e.g., appending numbers).
• GPU acceleration – using hashcat or oclHashcat for massive speed gains.

Typical dictionary command:

# Use rockyou.txt as the wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 00:11:22:33:44:55 capture_001-01.cap

If the key is not found, you can expand the search with a custom rule set or switch to a GPU‑based approach. The --pmkid flag also allows cracking of PMKID hashes, a newer shortcut that bypasses the need for a full handshake.

Full testing workflow

Putting the pieces together, a typical authorized WPA2 audit follows these steps:

1. Preparation: Verify legal permission, select a compatible NIC, and install the latest aircrack‑ng suite (often pre‑installed on Kali Linux).
2. Enable monitor mode with airmon-ng. Confirm the interface is in monitor state.
3. Identify the target using airodump-ng without filters to list nearby APs. Note BSSID, channel, and encryption type.
4. Focus the capture on the chosen AP and channel, writing output to a file.
5. Trigger a handshake:
   • If a client is already connected, wait for a natural reconnection.
   • Otherwise, use aireplay-ng deauth (or fakeauth) to force a reconnection.
6. Verify capture by opening the .cap file in aircrack-ng or Wireshark. Look for the “EAPOL” frames that indicate a complete handshake.
7. Crack the key with a dictionary, hybrid, or GPU‑accelerated attack. Record the time to crack and any observations about password complexity.
8. Report findings, include recommendations (e.g., stronger passwords, WPA3 migration), and note any legal constraints observed.

Mermaid diagram – workflow overview

flowchart TD
    A[Start: Legal permission] --> B[airmon-ng start wlan0]
    B --> C{Monitor mode OK?}
    C -- Yes --> D[airodump-ng -c CH -bssid BSSID -w capture]
    C -- No --> E[Fix driver / replace NIC] --> B
    D --> F{Handshake captured?}
    F -- Yes --> G[aircrack-ng -w wordlist -b BSSID capture.cap]
    F -- No --> H[aireplay-ng -0 deauth] --> D
    G --> I{Key found?}
    I -- Yes --> J[Report & remediate]
    I -- No --> K[Increase wordlist / GPU] --> G
    style A fill:#f9f,stroke:#333,stroke-width:2px
    style J fill:#9f9,stroke:#333,stroke-width:2px

Mermaid diagram – handshake capture process

sequenceDiagram
    participant Attacker as Attacker (airmon-ng/airodump-ng)
    participant AP as Access Point
    participant Client as Client Device
    Attacker->>AP: Switch to monitor mode (airmon-ng)
    Attacker->>AP: Listen on channel (airodump-ng)
    Note right of Attacker: Capture starts, waiting for EAPOL
    Client->>AP: Authentication Request
    AP->>Client: Authentication Response
    Client->>AP: Association Request
    AP->>Client: Association Response
    Client->>AP: 4‑way Handshake (EAPOL 1‑4)
    AP->>Attacker: Broadcast EAPOL frames (captured)
    Attacker->>Attacker: Save to .cap file
    alt Handshake incomplete
        Attacker->>Client: Deauth (aireplay-ng) 
        Client->>AP: Re‑associate (new handshake)
    else Handshake complete
        Attacker->>Attacker: Proceed to cracking
    end

Shiver Mesh and BLEShark Nano in practice

The Shiver mesh platform extends the testing horizon beyond a single AP. Built on ESP‑NOW, it can create a self‑forming network of up to 16 nodes, each with a 20‑50 m radio range. When you need to evaluate a distributed IoT deployment, you can deploy Shiver nodes to simulate rogue APs, capture traffic from multiple points, or test mesh‑specific security features such as replay protection.

The BLEShark Nano complements the aircrack‑ng workflow by providing a portable, battery‑powered sensor that can:

• Perform passive Wi‑Fi scanning and log beacon frames for later analysis.
• Capture BLE advertisements and store them as PCAP files, useful when testing hybrid Wi‑Fi/BLE devices.
• Execute deauthentication (disabled in EU firmware) and handshake capture in a handheld form factor.
• Run Bad‑BT scripts directly on the device, allowing on‑the‑fly manipulation of Bluetooth traffic.

Because the BLEShark Nano runs on an ESP32‑C3 (RISC‑V, 160 MHz) with a 500 mAh battery and USB‑C charging, it can stay on the field for several hours while you move between Shiver nodes, collecting data from multiple angles. The device’s firmware also supports OTA updates, so you can keep the toolchain in sync with the latest aircrack‑ng releases.

Kali Linux – the default platform for aircrack‑ng (Wikimedia Commons)

EU compliance notes

When operating in the European Union, the legal framework requires that any active attack (e.g., deauthentication) be performed only with explicit consent from the network owner. The BLEShark Nano respects this rule by shipping with the deauth function disabled in the EU firmware build. Users can still capture handshakes passively, which is sufficient for most security assessments. If you need to enable deauth for a non‑EU test, you must flash a firmware version that explicitly permits it and retain documentation of the authorization.

Conclusion

The aircrack‑ng suite remains a powerful, flexible set of tools for authorized WPA2 testing. By mastering airmon-ng, airodump-ng, aireplay-ng, and aircrack-ng, you can conduct end‑to‑end audits that reveal weak passwords, misconfigured encryption, and other vulnerabilities. Pairing the suite with modern hardware like the BLEShark Nano and the Shiver mesh expands your reach to IoT and mesh environments, while staying within legal boundaries thanks to EU‑compliant firmware options.

Remember that the strength of any security test lies not only in the tools but also in the methodology: obtain proper authorization, document each step, and provide actionable recommendations to the network owner.

Written by George Maxutov