Provided by: horst_4.2-1build1_i386 bug


       horst - Highly Optimized Radio Scanning Tool


       horst  [-h]  [-q]  [-D] [-i interface] [-t sec] [-d ms] [-b bytes] [-s]
       [-u] [-C] [-c IP] [-p port] [-o file] [-X name] [-x command]  [-e  mac]
       [-f pkt_name] [-m mode]


       horst  is  a small, lightweight IEEE802.11 wireless LAN analyzer with a
       text interface. Its basic function is similar to tcpdump, Wireshark  or
       Kismet,   but   it's  much  smaller  and  shows  different,  aggregated
       information which is not easily  available  from  other  tools.  It  is
       mainly  targeted  at  debugging  wireless  LANs  with a focus on ad-hoc
       (IBSS) mode in larger mesh networks. It can be useful to  get  a  quick
       overview  of  what's  going  on  on  all  wireless  LAN channels and to
       identify problems.

       · Shows signal values per station.

       · Calculates channel utilization ("usage") by adding up the  amount  of
         time the packets actually occupy the medium.

       · "Spectrum Analyzer" shows signal levels and usage per channel.

       · Text-based  "graphical"  packet history, with signal, packet type and
         physical rate

       · Shows all stations per ESSID and the live  TSF  per  node  as  it  is

       · Detects  IBSS  "splits"  (same ESSID but different BSSID - this  is a
         common driver problem).

       · Statistics of packets/bytes per physical rate and per packet type.

       · Has some support for mesh protocols (OLSR and batman).

       · Can filter specific packet types, source MAC addresses or BSSIDs.

       · Client/server support for monitoring on remote nodes.

       · Can be controlled via a named pipe.


       -h     Show summary of options.

       -q     Quiet mode. Don't show user interface. This is  only  useful  in
              conjunction  when  running  in  server mode (-C) or writing to a
              file (-o).

       -D     Show lot's of debugging output, including a full  package  dump.
              Only available when compiled with DEBUG=1.

       -i intf
              Operate  on  given  network  interface  instead  of  the default
              "wlan0". Note that the interface is assumed  to  be  in  monitor
              mode  already. See MONITOR MODE below for more information about
              preparing the network interface.

       -t sec Timeout (remove) nodes after not receiving packets from them for
              this time in seconds (default: 60 sec).

       -d ms  Display  update  interval.  The  default  value  of 100ms can be
              increased to reduce CPU load caused by redrawing the screen.

       -b bytes
              Receive buffer size. The receive buffer size can be set to  tune
              memory consumption and reduce lost packets under load.

       -s     Show  a  poor mans "spectrum analyzer". The same can be achieved
              by running horst as normal and pressing the button  's'  (Spec);
              then 'c' (Chan) and 'a' (Automatically change channel).

       -u     Upper channel limit for the automatic channel change.

       -C     Allow   client   connections.   Server  mode.  Only  one  client
              connection is supported at the moment (default: off).

       -c IP  Connect to a  horst  instance  running  in  server-mode  at  the
              specified IP address.

       -p port
              Use   the  specified  port  (default:  4444)  for  client/server

       -o filename
              Write a information about each received packet into  file.  Note
              that  you can send to STDOUT by using -o /dev/stdout. See OUTPUT
              FILE FORMAT below.

       -X     Accept control commands on a named pipe (default /tmp/horst).

       -Xname Accept control commands on a named pipe with given name  or  set
              pipe name used with -x.

       -x command
              Send  control  command  to another horst process who was started
              with -X and then exit. Multiple  commands  can  be  concatenated
              with ':'. Currently implemented commands are:
                  pause              Pause horst processing
                  resume             Resume horst processing
                  channel=X          Set channel channel number
                  channel_auto=X     Automatically change channels (1 or 0)
                  channel_dwell=X    Set channel dwell time when automatically
              changing channel (ms)
                  channel_upper=X     Set  max  channel   when   automatically
              changing channel
                  outfile=X          Write to outfile named X.
                                     If  the  file  is  already  open,  it  is
              cleared and re-openend.
                                     If filename is not specified ("outfile=")
              any existing file
                                     is closed and no file is written.

       -e MAC Filter  all  MAC  addresses  except  these, to show only packets
              originating from the specified MAC addresses. This option can be
              specified multiple times.

       -f pkt_type
              Filter  all  packets  except these. This option can be specified
              multiple  times.  For  valid  packet   names   see   NAMES   AND
              ABBREVIATIONS below.

              Only  show/include packets and nodes of this mode. Note that the
              mode is infered by the information of packets we received and it
              may  take  some  time  until a node is properly classified. This
              option can be specified multiple times.


       The ncurses-based text interface tries to display a lot of information,
       so  it  may  look  confusing  at first. Below we describe the different
       screens and options.

       Main screen

              The initial (main) screen is split into three parts.  The  upper
              area  shows  a  list  of aggregated "node" information, the most
              useful information about each sender which was  discovered,  one
              per line:
                      /             "Spinner" to show activity
                      Pk            Count of packets
                      Re%           Percentage of Re-sent frames
                      CH            Channel
                      Sig           Signal value (RSSI) in dBm
                      RAT           Physical data rate
                      TRANSMITTER   MAC address of sender
                      MODE           Operating  Mode (AP, AHD, PRB, STA, WDS),
              see "NAMES AND ABBREVIATIONS"
                      ENCR          Encryption (WPA1, WPA2, WEP)
                      ESSID         ESSID
                      INFO           Additional   info   like   "BATMAN",   IP

              The  lower  area  shows a scrolling list of packets as they come
                      CH            Channel
                      Sig           Signal value (RSSI) in dBm
                      RAT           Physical data rate
                      TRANSMITTER   MAC address of sender
                      BSSID         BSSID
                      TYPE          Packet type, see "NAMES AND ABBREVIATIONS"
                      INFO           Additional  info  like  ESSID,  TFS,   IP

              The lower right box shows bar graphs for:
                      Signal        of last received packet in green
                      bps           Bits per second of all received packets
                      Usage         Percentage of channel use

              The  lower  edge is the menu and status bar, it shows which keys
              to press for other screens. The status shows ">" when  horst  is
              running  or  "="  when  it  is paused, then "F" when any kind of
              filter is active, the Channel, the monitor interface in use  and
              the time.

       Pause ('p' or <space>)

              Can  be used to pause/resume horst. When horst is paused it will
              loose packets received in the mean time.

       Reset ('r')

              Clears all history and aggregated statistical data.

       History ('h')

              The history screen scrolls from right to left and  shows  a  bar
              for  each  packet indicating the signal level. In the line below
              that, the packet type is indicated by one character  (See  NAMES
              AND  ABBREVIATIONS  below)  and  the rough physical data rate is
              indicated below that in blue.

       ESSID ('e')

              The ESSID screen groups information by ESSID and shows the  mode
              (AP,  IBSS),  the MAC address of the sender, the BSSID, the TSF,
              the beacon  interval,  the  channel,  the  signal,  a  "W"  when
              encrytoion is used and the IP address if known.

       Statistics ('a')

              The  statistics  screen  groups  packets by physical rate and by
              packet type and shows other kinds of aggregated and  statistical
              information based on packets.

       Spectrum Analyzer ('s')

              The  "poor  mans spectrum analyzer" screen is only really useful
              when horst is started with the -s option or  the  "Automatically
              change channel" option is selected in the "Chan" settings.

              It  shows  the available channels horizontally and vertical bars
              for each channel:

                      Signal          in green
                      Physical rate   in blue
                      Channel usage   in orange/brown

              By pressing the 'n' key, the display can be changed to show only
              the  average  signal level on each channel and the last 4 digits
              of the MAC address of the individual nodes at the level (height)
              they  were received. This can give a quick graphical overview of
              the distance of nodes.

       Filters ('f')

              This configuration dialog can  be  used  to  define  the  active

       Channel Settings ('c')

              This  configuration  dialog  can  be  used to change the channel
              changing behaviour of horst or to change to a different  channel

       Sort ('o')

              Only  active  in  the  main screen, can be used to sort the node
              list in the upper area by Signal, Time, BSSID or Channel.


       802.11 standard frames

               Management frames:
               a    ASOCRQ    Association request
               A    ASOCRP    Associaion response
               a    REASRQ    Reassociation request
               A    REASRP    Reassociation response
               p    PROBRQ    Probe request
               P    PROBRP    Probe response
               T    TIMING    Timing Advertisement
               B    BEACON    Beacon
               t    ATIM      ATIM
               D    DISASC    Disassociation
               u    AUTH      Authentication
               U    DEAUTH    Deauthentication
               C    ACTION    Action
               c    ACTNOA    Action No Ack

               Control frames:
               w    CTWRAP    Control Wrapper
               b    BACKRQ    Block Ack Request
               B    BACK      Block Ack
               s    PSPOLL    PS-Poll
               R    RTS       RTS
               C    CTS       CTS
               K    ACK       ACK
               f    CFEND     CF-End
               f    CFENDK    CF-End + CF-Ack

               Data frames:
               D    DATA      Data
               F    DCFACK    Data + CF-Ack
               F    DCFPLL    Data + CF-Poll
               F    DCFKPL    Data + CF-Ack + CF-Poll
               n    NULL      Null (no data)
               f    CFACK     CF-Ack (no data)
               f    CFPOLL    CF-Poll (no data)
               f    CFCKPL    CF-Ack + CF-Poll (no data)
               Q    QDATA     QoS Data
               F    QDCFCK    QoS Data + CF-Ack
               F    QDCFPL    QoS Data + CF-Poll
               F    QDCFKP    QoS Data + CF-Ack + CF-Poll
               N    QDNULL    QoS Null (no data)
               f    QCFPLL    QoS CF-Poll (no data)
               f    QCFKPL    QoS CF-Ack + CF-Poll (no data)

               *    BADFCS    Bad frame checksum

       Packet types
              Similar to 802.11 frames above but higher level  and  as  a  bit
              field  (types  can  overlap,  e.g. DATA + IP) and including more
              information, like IP, ARP, BATMAN, OLSR...

               CTRL        0x000001    WLAN Control frame
               MGMT        0x000002    WLAN Management frame
               DATA        0x000004    WLAN Data frame
               BADFCS      0x000008    WLAN frame checksum (FCS) bad
               BEACON      0x000010    WLAN beacon frame
               PROBE       0x000020    WLAN probe request or response
               ASSOC        0x000040     WLAN  associaction   request/response
               AUTH        0x000080    WLAN authentication frame
               RTSCTS      0x000100    WLAN RTS or CTS
               ACK         0x000200    WLAN ACK or BlockACK
               NULL        0x000400    WLAN NULL Data frame
               QDATA       0x000800    WLAN QoS Data frame (WME/WMM)
               ARP         0x001000    ARP packet
               IP          0x002000    IP packet
               ICMP        0x004000    IP ICMP packet
               UDP         0x008000    IP UDP
               TCP         0x010000    IP TCP
               OLSR        0x020000    OLSR protocol
               BATMAN       0x040000     BATMAND  Layer3 or BATMAN-ADV Layer 2
               MESHZ       0x080000    MeshCruzer protocol

       Operating modes
              Bit field of operating mode type which is infered from  received
              packets. Modes may overlap, i.e. it is common to see STA and PRB
              at the same time.

               AP          0x01        Access Point (AP)
               ADH         0x02        Ad-hoc node
               STA         0x04        Station (AP client)
               PRB         0x08        Sent PROBE requests
               WDS         0x10        WDS or 4 Address frames
               UNKNOWN     0x20        Unknown e.g. RTS/CTS or ACK


       horst should work with any wireleass LAN card and driver which supports
       monitor mode, with either "prism2" or "radiotap" headers. This includes
       most modern mac80211-based drivers.

       You have to put your card in monitor mode and set the channel  manually
       before you start horst. Usually this has to be done as root.

       Note  that  depending on the wireless driver capabilities and versions,
       signal values and  ranges  may  be  different.  Also,  if  the  monitor
       interface  is added to an existing interface, the driver does not allow
       the channel to be changed.

       Using iw:
              iw wlan0 interface add mon0 type monitor


              sudo iw wlan1 set type monitor
              sudo iw wlan1 set channel 6

       Using iwconfig:
              iwconfig wlan0 mode monitor
              iwconfig wlan0 channel 1
              ifconfig wlan0 up

       Using madwifi:
              wlanconfig wlan0 create wlandev wifi0 wlanmode monitor

       Using hostap:
              iwconfig wlan0 mode monitor
              iwpriv wlan0 monitor_type 1


       The format of the output file (-o flag) is a comma  separated  list  of
       the following fields in the following order, one packet each line.

              802.11 MAC packet type name as defined in the section "NAMES AND

              Source MAC address

              Destination MAC address


              Higher level packet  name  as  defined  in  section  "NAMES  AND

              Signal strength in dBm

              Noise in dBm (always 0)

              Signal to Noise ratio in dB (always 0, redundant)

              Packet length (MAC)

              Physical data rate

              Received while tuned to this frequency.

              TFS timer value

              ESSID, network name

              Operating modes as defined in "NAMES AND ABBREVIATIONS".

              Channel number

              Encryption in use

              WPA1 Encryption in use

              RSN (WPA2) Encryption in use

       ip_src IP source address (if available)

       ip_dst IP destionation address (if available)

              OLSR message type (if applicable)

              OLSR number of neighbours (if applicable)


       tcpdump(1),          wireshark(1),          kismet(1),          README,


       horst was written by Bruno Randolf <>.

       This manual page was written by Antoine  Beaupré  <>,
       for the Debian project (and may be used by others).

                              September 23, 2014                      HORST(8)