Aircrack-ng Commands & Tutorial 2026 | Complete Wi-Fi Security Auditing Guide | A7 Security Hunters

Cybersecurity, Ethical Hacking, Penetration Testing
August 24, 2026

A7 Security Hunters · Wireless Security Auditing

Table of Contents

Aircrack-ng Commands & Tutorial 2026 — Complete Wi-Fi Security Auditing Guide

Complete Aircrack-ng guide covering authorized Wi-Fi security auditing, wireless packet analysis, monitoring concepts, WPA/WPA2 security, troubleshooting, and practical cybersecurity labs.

Aircrack-ng Wi-Fi Security Wireless Auditing WPA/WPA2 2026 Guide

← Nmap → Wireshark → Aircrack-ng → Burp Suite → Metasploit

What Is Aircrack-ng?

Aircrack-ng is a suite of wireless-network security assessment tools used to monitor, analyze, and test Wi-Fi networks in authorized environments. It is commonly used by cybersecurity professionals and students to study wireless protocols, capture wireless traffic, and evaluate Wi-Fi security configurations.

What is Aircrack-ng used for? Security professionals use Aircrack-ng for authorized Wi-Fi security auditing, wireless packet capture and analysis, WPA/WPA2 security assessment, and wireless network troubleshooting in controlled environments.

The basic workflow is: identify the wireless interface → enable monitor mode → capture wireless traffic → analyze packets → assess security → report findings.

Featured Snippet Answers

What is Aircrack-ng used for?

Aircrack-ng is used for authorized Wi-Fi security auditing, wireless packet capture, and wireless network analysis in controlled cybersecurity labs and assessments.

Is Aircrack-ng legal?

Aircrack-ng itself is legal software. Testing networks you own or have explicit written authorization to test is legal; testing networks without authorization is illegal and violates computer-misuse laws.

Is Aircrack-ng installed on Kali Linux?

Yes — Aircrack-ng is pre-installed on Kali Linux. The suite includes airodump-ng, aireplay-ng, aircrack-ng, and other wireless security tools.

What are the Aircrack-ng suite components?

The Aircrack-ng suite includes airodump-ng (packet capture), aireplay-ng (packet injection), aircrack-ng (WEP/WPA cracking), airmon-ng (interface management), airolib-ng (precomputed tables), and several other tools.

What is monitor mode in Aircrack-ng?

Monitor mode allows a wireless interface to capture all wireless traffic in range, regardless of the network it’s connected to. It’s essential for wireless security auditing.

Aircrack-ng Tutorial for Beginners

Aircrack-ng is one of the most comprehensive wireless security auditing suites available. Security professionals use it to evaluate Wi-Fi security configurations, study wireless protocols, and perform authorized network assessments.

Important: Only use Aircrack-ng against wireless networks and equipment that you own or are explicitly authorized to assess. Unauthorized wireless testing is illegal in most jurisdictions.

Why Wireless Security Auditing Matters

Wireless networks are ubiquitous — and often overlooked from a security perspective. Common wireless security issues include:

Weak encryption: WEP and insecure WPA/WPA2 configurations
Default credentials: Router and access point default passwords left unchanged
Poor signal management: Signal leaking beyond physical premises
Rogue access points: Unauthorized devices on the network
Misconfigured authentication: Weak or missing authentication mechanisms

A7 Security Hunters Training Insight: Wireless security should be learned from the protocol and network-design perspective first. In our training labs, students understand channels, authentication, encryption, packet capture, and defensive configuration before attempting any security assessment.

How to Install Aircrack-ng

Kali Linux

Aircrack-ng is pre-installed on Kali Linux. To update to the latest version:

Update Aircrack-ng on Kali

sudo apt update
sudo apt install aircrack-ng

Ubuntu and Debian

Install Aircrack-ng

sudo apt update
sudo apt install aircrack-ng

macOS

Install Aircrack-ng on macOS

brew install aircrack-ng

Verify the Installation

Check version

aircrack-ng --version

# Check available interfaces
airmon-ng

Note: Aircrack-ng requires a compatible wireless adapter that supports monitor mode and packet injection. Not all adapters support these features.

Understanding Wireless Interfaces

List wireless interfaces

airmon-ng

# Example output:
# Interface   Chipset         Driver
# wlan0       Intel 8265      iwlwifi
# wlan1       Atheros AR9271  ath9k_htc

Check interface details

iwconfig
# Shows wireless interface status, mode, and current network

Required Wireless Adapter Features

Monitor Mode

Allows the adapter to capture all wireless traffic in range without connecting to a network.

Packet Injection

Allows the adapter to send crafted packets to wireless networks for testing purposes.

Multiple Channels

Ability to switch between different Wi-Fi channels for comprehensive scanning.

Recommended adapters: Atheros AR9271, Alfa AWUS036ACH, and other chipset-based adapters with good Linux driver support.

Monitor Mode Concepts

Monitor mode allows a wireless interface to capture all 802.11 frames in range, regardless of the network they belong to.

Enable monitor mode

# Put interface into monitor mode
sudo airmon-ng start wlan0

# The interface will become wlan0mon (or similar)

Verify monitor mode

iw dev wlan0mon info
# Should show "type monitor"

Disable monitor mode

sudo airmon-ng stop wlan0mon

Kill conflicting processes

sudo airmon-ng check kill
# Terminates processes that may interfere with monitoring

Important: Enabling monitor mode disconnects the interface from any active network connections. Use monitor mode only in authorized lab environments.

Wireless Network Discovery

Scan for wireless networks

sudo airodump-ng wlan0mon

Understanding airodump-ng Output

Column	Description
BSSID	MAC address of the access point (router)
CH	Channel number the network is using
PWR	Signal strength (closer to 0 = stronger signal)
Enc	Encryption type (WEP, WPA, WPA2)
Cipher	Encryption cipher (CCMP, TKIP)
Auth	Authentication method (PSK, MGT)
ESSID	Network name (SSID)

Targeted Scanning

Scan on a specific channel

sudo airodump-ng --channel 6 wlan0mon

Scan for a specific network

sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon

Note: Always use --bssid and --channel to focus on specific networks and reduce interference from other networks.

Capturing Wireless Traffic in an Authorized Lab

Capture traffic to a file

sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture wlan0mon

Capture with verbose output

sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture --verbose wlan0mon

Understanding Capture Files

Airodump-ng creates several output files:

capture-01.cap — Packet capture file (Wireshark-compatible)
capture-01.csv — CSV format for analysis
capture-01.kismet — Kismet-compatible format
capture-01.log — Plain text log file

Best practice: Always save captures with --write to preserve evidence for reporting. Include timestamps and environment details in file names.

Understanding WPA/WPA2 Security

WPA (Wi-Fi Protected Access)

Replaced WEP as the standard security protocol
Uses TKIP encryption cipher
Introduced to address WEP vulnerabilities
Now considered less secure than WPA2

WPA2

Current standard for Wi-Fi security
Uses AES-CCMP encryption (stronger than TKIP)
Supports both personal (PSK) and enterprise (802.1X) modes
Vulnerable to KRACK attacks if not patched

WPA/WPA2 Handshake

The WPA/WPA2 4-way handshake is the process by which a client and access point authenticate:

Message 1: Access point sends ANonce to client

Message 2: Client sends SNonce to access point

Message 3: Access point sends GTK and MIC to client

Message 4: Client sends ACK to access point

Key concept: Capturing the full 4-way handshake is essential for WPA/WPA2 PSK auditing. Without it, cracking the pre-shared key is not possible.

Wireless Packet Analysis

View Packet Details

Analyze captured packets

# Using tcpdump to view capture
tcpdump -r capture-01.cap -n

# View specific packet type
tcpdump -r capture-01.cap -n -e

Filtering Wireless Packets

Filter by BSSID

tcpdump -r capture-01.cap -n -e wlan addr1 AA:BB:CC:DD:EE:FF

Filter for specific frame types

# Beacon frames
tcpdump -r capture-01.cap -n -e wlan type beacon

# Probe requests
tcpdump -r capture-01.cap -n -e wlan type probe-req

Pro tip: Combine Aircrack-ng captures with Wireshark for deeper protocol analysis. Wireshark provides better filtering and visualization capabilities.

Aircrack-ng Common Commands

Command	Purpose
`airmon-ng start wlan0`	Enable monitor mode
`airmon-ng stop wlan0mon`	Disable monitor mode
`airmon-ng check kill`	Kill interfering processes
`airodump-ng wlan0mon`	Scan for networks
`airodump-ng --bssid MAC --channel CH wlan0mon`	Target specific network
`airodump-ng --write capture wlan0mon`	Capture traffic to file
`aireplay-ng --deauth 5 -a AP_MAC wlan0mon`	Deauthentication attack
`aireplay-ng --test wlan0mon`	Test packet injection
`aircrack-ng -w wordlist.txt capture.cap`	Crack WPA/WPA2 handshake
`airolib-ng wpa-db --import wordlist.txt`	Import wordlist into database

Ethical reminder: These commands should only be used on networks and equipment you own or have explicit authorization to test.

Troubleshooting Wireless Interfaces

Issue	Possible Cause	Solution
Monitor mode not available	Adapter doesn’t support monitor mode	Use a compatible adapter (Atheros, Alfa)
No packets captured	Wrong channel or interface	Verify channel and interface; check `iw dev`
Network not visible	Distance or interference	Move closer; try different channels
Packet injection fails	Adapter doesn’t support injection	Test with `aireplay-ng --test`
Interface not found	Driver not loaded	Check `lsmod` and load appropriate driver
Permission denied	Need root privileges	Use `sudo` for all Aircrack-ng commands

Aircrack-ng vs Other Tools

Tool	Primary Purpose
Aircrack-ng	Wireless security auditing
Wireshark	Network packet and protocol analysis
Nmap	Network discovery and service identification
Kismet	Wireless network detection and monitoring
Netcat	Network connectivity and troubleshooting

Aircrack-ng vs Kismet

Aircrack-ng

Active security testing
Packet injection
WPA/WEP cracking
Command-line focused

Kismet

Passive monitoring
Network detection
Visual interface
Real-time mapping

Which to use? Use Aircrack-ng for active wireless security assessments. Use Kismet for wireless network discovery and monitoring. Many professionals use both tools together.

Wireless Security Best Practices

Use WPA3 (or WPA2 with AES)

WPA3 is the latest Wi-Fi security standard. If WPA3 is unavailable, use WPA2 with AES-CCMP encryption.

Strong Pre-Shared Keys

Use long, complex passwords for WPA2-PSK. Minimum 12 characters with mixed case, numbers, and symbols.

Disable WPS

Wi-Fi Protected Setup (WPS) is known to have security vulnerabilities. Always disable it on access points.

Regular Firmware Updates

Keep access point firmware updated to patch known vulnerabilities.

Hide SSID When Possible

Disabling SSID broadcast adds a small layer of security by making the network less visible.

Use Enterprise Authentication

For business environments, use WPA2-Enterprise with 802.1X authentication for stronger security.

Monitor for Rogue APs

Regularly scan for unauthorized access points on your network.

Use VPN on Public Wi-Fi

Always use a VPN when connecting to public or untrusted wireless networks.

Defense in depth: No single measure is sufficient. Combine strong encryption, complex passwords, regular updates, and monitoring to create robust wireless security.

Authorized Wi-Fi Security Lab

Lab environment: This example uses a deliberately vulnerable lab environment. All targets are under the control of the training organization. Never test networks you don’t have authorization to audit.

Scenario

You are conducting an authorized wireless security assessment on a lab Wi-Fi network to evaluate its security configuration.

Step 1 — Identify the Wireless Interface

List interfaces

sudo airmon-ng
# Identifies wlan0 as the wireless interface

Step 2 — Enable Monitor Mode

Enable monitor mode

sudo airmon-ng start wlan0
# Interface becomes wlan0mon

Step 3 — Kill Conflicting Processes

Kill interfering processes

sudo airmon-ng check kill

Step 4 — Discover Networks

Scan for networks

sudo airodump-ng wlan0mon

Step 5 — Focus on Target Network

Target specific network

sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write capture wlan0mon

Step 6 — Capture the 4-Way Handshake

Force reauthentication

# In a new terminal, send deauth frames
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# The handshake will appear in the capture window with "[ WPA handshake: AA:BB:CC:DD:EE:FF ]"

Step 7 — Crack the Handshake

Audit the handshake

sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

Step 8 — Report Findings

Document the findings and provide remediation recommendations:

Vulnerability: Weak WPA2-PSK password
Risk: Network compromise, unauthorized access
Remediation: Use 12+ character complex password, enable WPA3 if available

Lab takeaway: This exercise demonstrates how wireless security assessments are conducted in authorized environments. It shows why strong passwords, WPA3, and regular wireless audits are essential security controls.

Aircrack-ng Cheat Sheet

Purpose	Command
List interfaces	`sudo airmon-ng`
Enable monitor mode	`sudo airmon-ng start wlan0`
Disable monitor mode	`sudo airmon-ng stop wlan0mon`
Kill interfering processes	`sudo airmon-ng check kill`
Scan for networks	`sudo airodump-ng wlan0mon`
Target specific network	`sudo airodump-ng --bssid MAC --channel CH wlan0mon`
Capture traffic	`sudo airodump-ng --write capture wlan0mon`
Deauth attack	`sudo aireplay-ng --deauth 5 -a MAC wlan0mon`
Test packet injection	`sudo aireplay-ng --test wlan0mon`
Test WPA/WPA2 handshake	`sudo aircrack-ng -w wordlist.txt capture.cap`
Show wireless info	`iwconfig`
Show device info	`iw dev`

Save this: Bookmark this cheat sheet for quick reference during authorized wireless security labs and assessments.

Frequently Asked Questions About Aircrack-ng

What is Aircrack-ng?

Aircrack-ng is a suite of wireless-network security assessment tools used to monitor, analyze, and test Wi-Fi networks in authorized environments.

Is Aircrack-ng legal?

Aircrack-ng is legal software. Testing networks you own or have explicit written authorization to test is legal; testing networks without authorization is illegal.

Is Aircrack-ng installed on Kali Linux?

Yes — Aircrack-ng is pre-installed on Kali Linux.

What are the Aircrack-ng suite components?

The suite includes airodump-ng (packet capture), aireplay-ng (packet injection), aircrack-ng (WEP/WPA cracking), airmon-ng (interface management), and several other tools.

What is monitor mode?

Monitor mode allows a wireless interface to capture all wireless traffic in range, regardless of the network it’s connected to.

Can Aircrack-ng crack WPA2?

Aircrack-ng can crack WPA2-PSK when provided with a valid 4-way handshake and a suitable wordlist.

What is a WPA handshake?

A WPA/WPA2 4-way handshake is the authentication process between a client and access point. Capturing it is essential for WPA auditing.

How do I capture a WPA handshake?

Use airodump-ng to capture traffic, then use aireplay-ng to send deauth frames to force reauthentication.

What wireless adapters work with Aircrack-ng?

Adapters with Atheros AR9271, Intel 8265, and Alfa AWUS036ACH chipsets generally work well.

Is Aircrack-ng better than Kismet?

They serve different purposes. Aircrack-ng is for active security testing. Kismet is for passive network detection and monitoring.

Can Aircrack-ng be used for cybersecurity training?

Yes — It is useful for controlled wireless security labs and ethical hacking education.

How can organizations defend against wireless attacks?

Use WPA3, strong passwords, disable WPS, enable regular firmware updates, monitor for rogue APs, and use enterprise authentication when possible.

Aircrack-ng: Quick Expert Summary

Aircrack-ng is a comprehensive wireless security auditing suite. It helps cybersecurity professionals evaluate Wi-Fi security configurations in authorized environments.

The most important concepts to learn are: monitor mode, packet capture, WPA/WPA2 handshakes, network discovery, packet injection, and defensive wireless security.

A professional workflow should always include authorization, controlled testing, evidence collection, remediation, and retesting.

Official & Authoritative Resources

Aircrack-ng Official

aircrack-ng.org

Official documentation, downloads, and tutorials.

Kali Linux

Kali Linux Aircrack-ng Package

Kali-specific package information.

IEEE 802.11

IEEE 802.11 Working Group

Official Wi-Fi standards documentation.

Wi-Fi Alliance

Wi-Fi security standards and certification information.

NIST Wireless Security

NIST Wireless Security Guidelines

Government wireless security recommendations.

OWASP

OWASP Wireless Security

Wireless security guidance for application security professionals.

Last Updated: August 2026

About Us

A7 Security Hunters is a leading provider of cybersecurity certifications and training, offering both online and offline courses tailored to professionals at all levels. Our comprehensive programs cover key areas like ethical hacking, network security, and threat management, designed to equip individuals with the skills to succeed in the fast-paced world of cybersecurity. With expert instructors and hands-on learning, A7 Security Hunters ensures you gain practical knowledge and industry-recognized certifications to advance your career in cybersecurity.

Cybersecurity Training & Certifications

Most Recent Posts

All Post
Black Hat Hacking
CTF Challenges
Cybersecurity
Ethical Hacking
Forensic
Google Trends
Penetration Testing
Red Teaming
Web Penetration Testing