Wireless Attackswirelesswlananalyzermonitorspectrumibssmeshscanning

horst

horst is a small, lightweight IEEE802.11 WLAN analyzer with a text interface for debugging wireless LANs. It provides aggregated information like signal values per station, channel utilization, and spectrum analysis, optimized for quick overviews rather than deep packet inspection.

Description

horst is designed for troubleshooting wireless LANs, particularly in Ad-hoc (IBSS) mode and mesh networks. It offers unique features such as displaying RSSI values per station, calculating channel utilization by measuring medium occupancy time, and a spectrum analyzer view showing signal levels and usage per channel. The tool excels at providing rapid insights into wireless activity across all channels, helping identify problems like IBSS splits caused by driver issues.

Use cases include monitoring live TSF timestamps per node, viewing graphical packet history with signal strength and rates, and generating statistics on packets and bytes by physical rate and type. It supports filtering by packet types, operating modes, source addresses, or BSSIDs, and includes client/server capabilities for remote monitoring. Special support for mesh protocols like OLSR and batman makes it valuable for advanced wireless setups.

Unlike tools like Wireshark or Kismet, horst prioritizes a compact text-based interface and aggregated metrics over detailed packet captures, automatically managing monitor interfaces on Linux systems with compatible wireless hardware.

How It Works

horst operates in monitor mode on IEEE802.11 wireless interfaces, capturing and aggregating packet data to display real-time metrics like RSSI per station, channel utilization (time-based medium occupancy), and spectrum analysis across channels. It processes frames to show graphical packet history with signal levels, physical rates, and types, while tracking TSF timers, detecting IBSS splits via ESSID/BSSID mismatches, and computing statistics per rate and packet type. Filters apply inclusively to limit displayed data, with client/server modes using TCP sockets for remote control and data relay over specified ports.

Installation

bash
sudo apt install horst

Flags

-vshow version
-hHelp
-qQuiet, no output
-DShow lots of debug output, no UI
-aAlways add virtual monitor interface
-c <file>Config file (/etc/horst.conf)
-C <chan>Set initial channel
-i <intf>Interface name (wlan0)
-s(Poor mans) Spectrum analyzer mode
-uUpper channel limit
-NAllow network connection, server mode (off)
-n <IP>Connect to server with <IP>, client mode (off)
-p <port>Port number of server (4444)
-o <filename>Write packet info into 'filename'
-X[filename]Allow control socket on 'filename' (/tmp/horst)
-x <command>Send control command
-e <MAC>Source MAC addresses (xx:xx:xx:xx:xx:xx), up to 9 times
-f <PKT_NAME>Filter packet types, multiple
-m <MODE>Operating mode: AP|STA|ADH|PRB|WDS|UNKNOWN, multiple
-B <MAC>BSSID (xx:xx:xx:xx:xx:xx), only one

Examples

Display help and usage information
horst -h
Show version information
horst -v
Use specific interface wlan0 for scanning
horst -i wlan0
Start scanning on channel 6
horst -C 6
Enable spectrum analyzer mode
horst -s
Start in server mode listening on port 4444
horst -N -p 4444
Connect as client to remote server at 192.168.1.100
horst -n 192.168.1.100
Write packet information to capture.txt file
horst -o capture.txt
Updated 2026-04-16kali.org ↗