Techzone/Airgraph-ng — WiFi Network Visualization

Airgraph-ng — WiFi Network Visualization

3 min readArticle

Airgraph-ng is a tool in the aircrack-ng suite that takes airodump-ng CSV output and renders it as a visual network graph. It produces two graph types: CAPR (Client to AP Relationship) and CPG (Common Probe Graph). Used to make sense of wardriving captures — quickly visualize which clients connect to which APs and which devices have been at the same locations.

Prerequisites

bash 
sudo apt install aircrack-ng graphviz
pip3 install python-igraph cairocffi      # graph rendering dependencies

airgraph-ng --help    # verify install

Step 1: Collect Data with Airodump-ng

Airgraph-ng reads the CSV file that airodump-ng generates automatically with -w:

bash 
sudo airmon-ng start wlan0

# Capture — let it run 5–30 min for useful data
sudo airodump-ng wlan0mon -w wardriving_session --output-format csv

# Output files:
#   wardriving_session-01.csv   ← airgraph-ng reads this
#   wardriving_session-01.cap   ← packet capture for further analysis

The CSV has two sections: APs first (BSSID, channel, encryption, ESSID), then clients (their MAC, associated AP BSSID, and probe history).

CAPR Graph — Client to AP Relationship

Shows which clients are associated to which APs. Useful for site surveys and identifying orphaned/unassociated clients.

bash 
airgraph-ng -i wardriving_session-01.csv -g CAPR -o capr.png
open capr.png        # macOS
eog capr.png         # Linux

Color coding by encryption:

Color Encryption
Green Open (no encryption)
Yellow WEP
Orange WPA
Red WPA2
Purple WPA3

Instantly spot open or WEP networks in a dense scan without reading individual labels.

CPG Graph — Common Probe Graph

Shows which client devices have probed for the same SSIDs — edges connect clients that share probe history. Useful for device tracking across locations: two devices probing for "HomeNetwork" were probably in the same home before.

bash 
airgraph-ng -i wardriving_session-01.csv -g CPG -o cpg.png

Note: MAC randomization defeats CPG correlation — modern iOS and Android randomize probe MACs, so CPG is most useful against older devices or in enterprise environments.

Full Wardriving Workflow

bash 
# 1. Capture (drive/walk the area)
sudo airodump-ng wlan0mon -w site_survey --output-format csv,pcap

# 2. Stop capture (Ctrl+C)

# 3. Generate both graphs
airgraph-ng -i site_survey-01.csv -g CAPR -o site_survey_capr.png
airgraph-ng -i site_survey-01.csv -g CPG  -o site_survey_cpg.png

# 4. View
open site_survey_capr.png &
open site_survey_cpg.png &

Extracting Client Probe Data from CSV

bash 
# Print all client MACs and their probed SSIDs
awk 'NR>2' site_survey-01.csv | awk -F',' '/^[0-9A-Fa-f]/{print $1 " probes: " $7}'

# Find clients probing for a specific SSID
grep -i "TargetSSID" site_survey-01.csv

# Find clients not associated to any AP (unattached devices)
awk -F',' '$6 ~ /not associated/' site_survey-01.csv | cut -d',' -f1

Limitations and Tips

  • Graphs with 50+ nodes become unreadable — filter the CSV to a specific BSSID or channel before graphing in dense urban captures
  • CPG is only reliable if clients have non-randomized MACs
  • For large datasets, sort and filter unlocked targets first:
bash 
# Show only open networks from the AP section of the CSV
awk -F',' 'NR>2 && $6 ~ /OPN/' wardriving_session-01.csv | cut -d',' -f1,14

Reference

techzonesite.comUnlock Your IT Potential