Despite this exercise covering only broadcast data, check the local laws which might cover this process before conducting it. Consider how it looks to third parties as you are scanning a network, especially from outside an office. Confirm that all devices you are accessing/scanning belong to the organization. Delete all devices from your scan that do not belong to the organization. Study outputs for any obviously embarrassing personal information (especially network beacon records) before sharing. Walkthrough Step 1: Monitor Mode You should disconnect from any wifi network you may be connected to to capture the widest amount of data. Switch your wireless adapter to monitor mode** $ airmon-ng start <interface> You may need to stop your network manager system to prevent it from interfering. Running $ airmon-ng check to list anything that is causing problems, and $ airmon-ng check kill to try and stop them automatically, and running stop network-manager && stop avahidaemon may keep them from re-starting automatically. Step 2: Listen for wifi probes. Run airodump-ng on the monitor mode interface (usually mon0). This listens to wifi beacons and you can begin analyzing who is on what network, and see historical networks. airodump-ng -w filename mon0 This scans all networks and channels, collecting broadcast network information. Note Page 129 of 240