hcxdumptool

hcxdumptool captures the same kind of traffic airodump-ng does — WPA handshakes and PMKIDs — but is written specifically to feed the hcxtools/hashcat conversion pipeline rather than the older .cap/aircrack-ng format, and it’s more aggressive about soliciting a PMKID from an AP without needing a connected client at all. wifite shells out to it for its own PMKID capture path.

It lives at Security → Wireless Attacks → hcxdumptool (a subcategory — hcxdumptool and hcxnmealog each get their own entry). Needs root and a monitor-mode interface.

The help it prints

Show the full output39 lines
hcxdumptool 7.1.2  (C) 2026 ZeroBeat
usage: hcxdumptool <options>

most common options:
--------------------
-i <INTERFACE>   : name of INTERFACE to be used
                    default: first suitable INTERFACE
                    warning:
                     hcxdumptool changes the mode of the INTERFACE
                     hcxdumptool changes the virtual MAC address of the INTERFACE
                     hcxdumptool changes the channel of the INTERFACE
-w <outfile>     : write packets to a pcapng-format file named <outfile>
                    default outfile name: yyyyddmmhhmmss-interfacename.pcapng
                    existing file will not be overwritten
-c <digit>       : set channel (1a,2a,36b,...)
                    default: 1a,6a,11a
                    it is mandatory to add band information to the channel number (e.g. 12a)
                     band a: NL80211_BAND_2GHZ
                     band b: NL80211_BAND_5GHZ
                     band c: NL80211_BAND_6GHZ
-f <digit>       : set frequency (2412,2417,5180,...)
-F               : use all available frequencies from INTERFACE
-t <second>      : minimum stay time (will increase on new stations and/or authentications)
                    default 5 seconds
-A               : ACK incoming frames (INTERFACE must support active monitor mode)
-L               : show PHYSICAL INTERFACE list and terminate
-l               : show PHYSICAL INTERFACE list (tabulator separated and greppable) and terminate
-I <INTERFACE>   : show detailed information about INTERFACE and terminate
--bpfc=<filter>  : compile Berkeley Packet Filter (BPF) and exit
--rds=<digit>    : enable real time display (attack mode overview on screen)
--rcascan=<mode> : radio channel assessment scan
                    (a)ctive = active scan (transmit undirected PROBEREQUEST frames)
                    (p)assive = passive scan (listen only)
-h               : show this help
-v               : show version

... (abridged — see `hcxdumptool --help` for BPF filter design workflow and
    the important-recommendations section: don't run it on a shared
    interface, don't set monitor mode with a separate tool first)

Examples

# General-purpose capture across the default channels, writing a pcapng file
sudo hcxdumptool -i wlan0mon -w capture.pcapng

# Active scan first, to see what's actually in range before committing to a channel
sudo hcxdumptool -i wlan0mon --rcascan=active -F

# Convert the capture for cracking — see hcxtools
hcxpcapngtool -o capture.hc22000 capture.pcapng