2

I am wanting to monitor a MAC address for activity on my network using airodump-ng

I am currently:

First running this:

airodump-ng mon0 --write t

which writes to the file t-01.csv a csv with the format:

Station MAC, First time seen, Last time seen, Power, # packets, BSSID, Probed ESSIDs

then I have a bash script that does this:

while [ true ]
do
    t=`cat t-01.csv | grep '30:F1:DA:7B:F3:2C' | cut -d ',' -f5`
    if [[ "$t" != "$lt" ]]
    then
            lt="$t"
            echo "activity"
    fi
done

Which is basically watching the MAC address for a change in the # packets and when it changes it means there has been some activity. But the airodump-ng seems to have an immense lag when writing to a file (around 1-2 seconds) Is there an alternative way to do this, that is faster?

Found my answer:

https://networkengineering.stackexchange.com/questions/19737/tcpdump-filter-by-mac-address/19741#19741?newreg=8e32529cbc7c4234b3a062bb655b7e5f

I can then write a script like:

#!/bin/bash
tcpdump -i mon0 ether host "30:F1:DA:7B:F3:2C" | while read b; do
    echo "Activity!"
done
Community
  • 1
maxisme
  • 275
  • 2
  • 15
  • I suggest moving your answer into an answer. It's ok to answer your own question on SE. – ki9 Jan 01 '21 at 07:41

1 Answers1

0

Instead of cat-ing the file each time, use:

tail -f t-01.csv | grep '30:F1:DA:7B:F3:2C' | cut -d ',' -f5`

and the rest of the script is the same.

Reggie85
  • 9
  • 1