Aircrack-ng Tutorial: Capture a WPA2 Handshake on Your Own Network

Why aircrack-ng, in a world of hashcat and hcxtools

Aircrack-ng predates almost every other WiFi tool in common use. It was written in 2006 around the airodump-ng sniffer and an in-suite cracker that targeted WEP, then grew to cover WPA and WPA2. Today the cracker part is largely superseded by hashcat, which runs on a GPU, and by hcxtools, which handles captures more cleanly for hashcat mode 22000. What the suite still owns is the capture side: airmon-ng reliably flips almost any supported card into monitor mode, airodump-ng is the canonical sniffer, and aireplay-ng is the reference implementation of 802.11 injection attacks. You use aircrack-ng to get the .cap. You use hashcat to crack it.

The suite ships out of the box on Kali and Parrot and is one apt install away on Debian, Ubuntu, and Arch. On macOS and Windows it is technically possible but dramatically less reliable because of driver limitations; this article assumes a Linux laptop with a supported USB card.

Installation on Kali and Debian-family Linux

On Kali, aircrack-ng is preinstalled. To confirm and update to the latest:

sudo apt update
sudo apt install -y aircrack-ng
aircrack-ng --help | head -n 5

On plain Debian 12 or Ubuntu 24.04 the same two commands install the entire suite (airmon-ng, airodump-ng, aireplay-ng, aircrack-ng, airbase-ng, packetforge-ng, ivstools, and a handful of helpers). On Arch use sudo pacman -S aircrack-ng. Verify you are on the current release — 1.7 or later (1.7 shipped on 2022-05-10).

You will also want a companion tool for the conversion step later:

sudo apt install -y hcxtools    # provides hcxpcapngtool

If apt does not have hcxtools in the stable repo of your distro, grab it from the upstream GitHub; the build is a one-liner.

Step 1 — Identify the wireless interface

Plug your USB card in or turn on the internal radio, then ask the kernel what it sees:

iw dev
# Interface wlan0
#    ifindex 3
#    wdev 0x1
#    type managed
#    txpower 20.00 dBm

The interface you want is usually wlan0, occasionally wlx followed by a MAC (systemd predictable name). Write it down; every command below references it.

Step 2 — Kill NetworkManager and enter monitor mode

In normal (managed) mode the kernel only hands you frames addressed to your MAC. Monitor mode asks the driver to pass every 802.11 frame the radio can hear, including beacons, probes, and EAPOL handshakes that belong to other stations. Airmon-ng flips that switch and renames the interface by appending mon.

sudo airmon-ng check kill
sudo airmon-ng start wlan0

# expected output includes:
#   (monitor mode vif enabled on wlan0mon)
iw dev wlan0mon info    # should now show type monitor

The check kill step terminates wpa_supplicant and NetworkManager because they fight monitor mode by trying to reassociate your card every few seconds. Expect to lose internet on this interface until you bring managed mode back at the end.

Step 3 — Scan the air with airodump-ng

Airodump-ng shows two live tables: access points (top) and associated stations (bottom). Run the unfocused scan first to locate your own SSID and note its BSSID and channel.

sudo airodump-ng wlan0mon

# top table columns of interest:
# BSSID               PWR  CH   ENC  ESSID
# AA:BB:CC:DD:EE:FF   -42  6    WPA2 MyHomeWiFi

# bottom table columns:
# BSSID               STATION           PWR  Rate
# AA:BB:CC:DD:EE:FF   11:22:33:44:55:66 -53  54e

Press Ctrl+C once you have your own BSSID and its channel. The PWR column is a negative signal number in dBm; closer to zero is stronger. If your own network reads worse than -70 dBm, move closer to the AP or your capture will be full of malformed frames.

Step 4 — Targeted capture on one channel

An unfocused capture hops across channels and misses frames. For a handshake you want the card pinned to the AP's channel, the BSSID as a filter, and a write target on disk:

sudo airodump-ng \
  -c 6 \
  --bssid AA:BB:CC:DD:EE:FF \
  -w capture \
  wlan0mon

# the header shows:
#  CH 6 ][ Elapsed: 42 s ][ 2026-04-21 14:33 ][ WPA handshake: AA:BB:CC:DD:EE:FF

When the WPA handshake marker appears in the top-right of the header, you have it. The -w capture flag writes capture-01.cap and a few companion files in the current directory. Leave airodump running another 10–20 seconds to let the full 4-way complete, then stop with Ctrl+C.

Step 5 — Trigger a reconnect with aireplay-ng (your device only)

A client already associated with the AP will not produce a handshake on its own. You have two options: wait for it to drop and reconnect organically (minutes to hours), or nudge it. On a network you own, with a client you own, the nudge is a short deauth burst:

# Deauth 3 frames, targeting your own phone only.
sudo aireplay-ng \
  --deauth 3 \
  -a AA:BB:CC:DD:EE:FF \
  -c 11:22:33:44:55:66 \
  wlan0mon

# --deauth 3    number of deauth frames (keep low)
# -a            AP BSSID
# -c            client MAC  (omit for broadcast deauth, which hits everyone — don't)

Three frames is plenty. Clients that do not use PMF react to a single well-formed deauth and reassociate within a second. If the AP has PMF/802.11w enabled — mandatory on WPA3, optional on WPA2, and often on by default on recent routers — unprotected deauth frames are ignored and this step will never trigger a reconnect; capture organically instead. Flooding with hundreds of frames is noisy, stresses the AP, and trips some IDS sensors. The -c client filter is not optional on a shared network: omitting it sends a broadcast deauth that kicks every device, which in an apartment block hits your neighbours' devices too. That would be the unauthorized-access crime this tutorial avoids.

Switch back to the airodump terminal. Within two seconds you should see the WPA handshake marker appear. If it does not, wait, then fire another three-frame deauth at the same client — and if that still changes nothing, stop and let the client reconnect on its own rather than flooding the channel.

Step 6 — Verify the capture

Before you leave the target network's RF range, confirm the .cap contains a complete handshake. Aircrack-ng has a built-in sanity check:

aircrack-ng capture-01.cap

# Opening capture-01.cap
# Read 1834 packets.
#
#    #  BSSID              ESSID       Encryption
#    1  AA:BB:CC:DD:EE:FF  MyHomeWiFi  WPA (1 handshake)
#
# Choosing first network as target.

The (1 handshake) annotation is what you want. If you see (0 handshakes), airodump captured frames but not a complete 4-way. Run another deauth and extend the capture. For a deeper look at what a valid handshake contains see our handshake primer.

Step 7 — Convert to hc22000 for hashcat

Cracking with aircrack-ng's own CPU cracker is a museum exercise today. Every serious workflow pushes the capture into hashcat mode 22000, which runs on a GPU. The conversion is one command:

hcxpcapngtool -o handshake.hc22000 capture-01.cap

# summary lines of interest:
# EAPOL messages (total).......: 12
# EAPOL pairs (total)..........: 2
# EAPOL pairs (best).............. 1
# EAPOL M1M2 ROGUE (total)........: 0
# EAPOL ANONCE error corrections (NC)......: working|not detected

The terminal output shown throughout this guide is illustrative — line layout and counts vary by tool version, so treat it as an example rather than a verbatim transcript. The resulting handshake.hc22000 is what hashcat wants. If you are unsure whether the conversion succeeded, upload it to the handshake analyzer — it identifies the container format and reports whether a handshake marker is present. That check is advisory: it can miss data in large captures and does not give a per-message M1/M2/M3/M4 breakdown. For format background and troubleshooting see the hccapx to hc22000 conversion guide.

Step 8 — Restore the card to managed mode

When you are done, bring the card back so you can get online again:

sudo airmon-ng stop wlan0mon
sudo systemctl start NetworkManager

NetworkManager restarts wpa_supplicant and reconnects you to your normal SSID. Confirm with nmcli dev wifi or the system tray icon.

Common failure modes

• Airmon-ng creates the interface but airodump sees nothing. The card's regulatory domain may not permit the AP's channel. Check it with iw reg get, then set the AP's actual country with sudo iw reg set — for channels 12–13 that means a domain which permits them (for example DE or JP); US permits only channels 1–11, so it would disable 12–13 rather than enable them. Note the limit: iw reg set can only restrict what the firmware allows, so if the card is firmware-locked to US you may never get 12–13.
• Airodump shows WPA handshake but aircrack-ng says 0 handshakes. An M1+M2 pair from the same handshake is enough — M1 carries the ANonce, M2 the SNonce and MIC; M3/M4 are not needed for cracking. Aircrack-ng reports 0 handshakes when only M2 was captured, when the nonces come from two different handshakes (nonce/replay-counter mismatch), or when the AKM is unsupported (e.g. FT-PSK) — not because M3/M4 are missing.
• Capture file is huge but nothing useful. The channel hopped because you forgot -c. Set the channel explicitly and re-capture.
• Client never deauths. Many clients ignore broadcast deauth frames, and clients with PMF/802.11w enabled ignore unprotected deauth entirely. Keep the deauth targeted with -c, and if it has no effect, physically toggle WiFi on the client — the reconnect produces a genuine handshake.
• aireplay-ng prints "WARNING: Detected AP rate limiting, waiting 60 seconds before re-checking". The AP is throttling your frames, not your USB bus. Send fewer frames (--deauth 1) and wait out the 60-second window. Use --ignore-negative-one only if injection is genuinely mis-negotiated.
• Injection fails or TX rates are low. Unpowered hubs and USB 2.0 links are a common cause — move the card to a direct port and test injection with aireplay-ng --test.

What aircrack-ng will not do in 2026

The suite dates from the WEP era and carries the assumptions of that era. There are three modern attack surfaces it does not cover:

• PMKID-only capture. The PMKID rides either in the RSN IE of a (Re)Association Request (management frame) or in the PMKID KDE inside EAPOL-Key M1 — two different frames, neither of them 802.11w/PMF and neither a beacon. Aircrack-ng itself has handled PMKID cracking since 1.4 (airodump-ng has detected PMKIDs since 1.6, and a PMKID-only capture reports as "WPA (0 handshake, with PMKID)"), but the suite does not export a WPA*01* hash line for the hashcat 22000 pipeline; hcxpcapngtool does, writing the PMKID into the same .hc22000 file hashcat -m 22000 reads (PMKID-only cracking was the old -m 16800). The AP-side variant needs no deauth and no completed 4-way — only a client's association frame.
• WPA3-SAE. WPA3 replaces the PSK handshake with SAE, which does not yield an offline-verifiable transcript. Aircrack-ng can sniff SAE frames but cannot crack them. See the WPA3 vs WPA2 comparison for the protocol detail.
• Modern enterprise WPA2/802.1X. RADIUS-backed WPA2-Enterprise does not use a shared PSK; the credentials are per-user EAP identities. Different suite, different article.

Lab environment recommendations

The cleanest way to practice without touching a network you do not own is a dedicated lab AP. A cheap router flashed with OpenWrt, set to WPA2-PSK with a known passphrase on channel 6, and air-gapped from your real home network, is the correct setup. Isolate it in a faraday bag or a metal box if you live close to neighbours and want to be certain your deauth traffic stays local. This is also the only way to practice aireplay-ng at higher packet rates without the ethical and legal footguns of open-air testing.

For troubleshooting workflow end-to-end, our full recovery guide maps every stage from capture to crack to deliverable password. For the command-line reference on Windows, macOS, and Linux outside the aircrack-ng suite, the CLI cheatsheet covers native OS tools.

Frequently asked questions

Recap

• Install aircrack-ng plus hcxtools (for the 22000 conversion).
• Kill NetworkManager, start monitor mode on wlan0, verify with iw dev.
• Unfocused airodump-ng to locate your SSID, then targeted capture pinned to the channel and BSSID.
• Short, client-scoped deauth with aireplay-ng to trigger reconnect.
• Verify with aircrack-ng, convert to hc22000, feed to hashcat or our recovery service.

Network tested: your own. Written authorization: yours. Keep it that way.