HORST(8)                    System Manager's Manual                   HORST(8)

       horst - Highly Optimized Radio Scanning Tool

       horst [-v] [-h] [-q] [-D] [-a] [-c file] [-C channel] [-i interface]
       [-t sec] [-V view] [-d ms] [-b bytes] [-M file] [-s] [-u] [-N] [-n IP]
       [-p port] [-o file] [-X name] [-x command] [-e mac] [-f pkt_name] [-m
       mode] [-B BSSID]

       horst is a small, lightweight IEEE802.11 wireless LAN analyzer with a
       text interface. Its basic function is similar to tcpdump, Wireshark or
       Kismet, but it's much smaller and shows different, aggregated
       information which is not easily available from other tools. It is
       mainly targeted at debugging wireless LANs with a focus on ad-hoc
       (IBSS) mode in larger mesh networks. It can be useful to get a quick
       overview of what's going on on all wireless LAN channels and to
       identify problems.

       · Shows signal values per station.

       · Calculates channel utilization ("usage") by adding up the amount of
         time the packets actually occupy the medium.

       · "Spectrum Analyzer" shows signal levels and usage per channel.

       · Text-based "graphical" packet history, with signal, packet type and
         physical rate

       · Shows all stations per ESSID and the live TSF per node as it is

       · Detects IBSS "splits" (same ESSID but different BSSID - this is a
         common driver problem).

       · Statistics of packets/bytes per physical rate and per packet type.

       · Has some support for mesh protocols (OLSR and batman).

       · Can filter specific packet types, source MAC addresses or BSSIDs.

       · Client/server support for monitoring on remote nodes.

       · Can be controlled via a named pipe.

       See MONITOR MODE below for more information about the network interface

       -v     Show version.

       -h     Show summary of options.

       -q     Quiet mode. Don't show user interface. This is only useful in
              conjunction when running in server mode (-C) or writing to a
              file (-o).

       -D     Show lot's of debugging output, including a full package dump.
              Only available when compiled with DEBUG=1.

       -a     Always add virtual monitor interface. Don't try to set existing
              interface to monitor mode.

       -c configfile
              Use configfile instead of the default "/etc/horst.conf".

       -C channel
              Set inital channel (number not frequency).

       -i intf
              Operate on the given network interface instead of the default

       -t sec Timeout (remove) nodes after not receiving packets from them for
              this time in seconds (default: 60 sec).

       -V view
              Display 'view'. Valid view names are "history", "hist", "essid",
              "statistics", "stats", "spectrum", "spec".

       -d ms  Display update interval. The default value of 100ms can be
              increased to reduce CPU load caused by redrawing the screen.

       -b bytes
              Receive buffer size. The receive buffer size can be set to tune
              memory consumption and reduce lost packets under load.

       -M filename
              MAC address to host name mapping file. The file can either be a
              dhcp.leases file from dnsmasq or contain mappings in the form
              "MAC<space>name" (e.g.: "00:01:02:03:04:05 test") line by line
              (default filename: /tmp/dhcp.leases).

       -s     Show a poor mans "spectrum analyzer". The same can be achieved
              by running horst as normal and pressing the button 's' (Spec);
              then 'c' (Chan) and 'a' (Automatically change channel).

       -u     Upper channel limit for the automatic channel change.

       -N     Allow client connections. Server mode. Only one client
              connection is supported at the moment (default: off).

       -n IP  Connect to a horst instance running in server-mode at the
              specified IP address.

       -p port
              Use the specified port (default: 4444) for client/server

       -o filename
              Write a information about each received packet into file. Note
              that you can send to STDOUT by using -o /dev/stdout. See OUTPUT
              FILE FORMAT below.

       -X     Accept control commands on a named pipe (default /tmp/horst).

       -X name
              Accept control commands on a named pipe with given name or set
              pipe name used with -x.

       -x command
              Send control command to another horst process who was started
              with -X and then exit. Multiple commands can be concatenated
              with ';'. Currently implemented commands are:

                     Pause horst processing

                     Resume horst processing

                     Reset all history, statistics and views

                     Set channel channel number

                     Automatically change channels (1 or 0)

                     Set channel dwell time when automatically changing
                     channel (ms)

                     Set max channel when automatically changing channel

                     Write to outfile named X. If the file is already open, it
                     is cleared and re-openend.  If filename is not specified
                     ("outfile=") any existing file is closed and no file is

       -e MAC Filter all MAC addresses except these, to show only packets
              originating from the specified MAC addresses. This option can be
              specified multiple times.

       -f pkt_type
              Filter all packets except these. This option can be specified
              multiple times. For valid packet names see NAMES AND
              ABBREVIATIONS below.

              Only show/include packets and nodes of this mode. Note that the
              mode is infered by the information of packets we received and it
              may take some time until a node is properly classified. This
              option can be specified multiple times.

       -B BSSID
              Only show/include packets which belong to the given BSSID.

       The ncurses-based text interface tries to display a lot of information,
       so it may look confusing at first. Below we describe the different
       screens and options.

       Main screen

              The initial (main) screen is split into three parts. The upper
              area shows a list of aggregated "node" information, the most
              useful information about each sender which was discovered, one
              per line:

                            "Spinner" to show activity

                            Percentage of this node's packets in relation to
                            all received packets

                            Percentage of retried frames of all frames this
                            node sent

                            Channel number

                            Signal value (RSSI) in dBm

                            Physical data rate

                            MAC address of sender

                            Operating Mode (AP, AHD, PRB, STA, WDS), see
                            "NAMES AND ABBREVIATIONS"

                            Encryption (WPA1, WPA2, WEP)


                            Additional info like "BATMAN", IP address...

              The lower area shows a scrolling list of packets as they come

                            Channel number

                            Signal value (RSSI) in dBm

                            Physical data rate

                            MAC address of sender


                            Packet type, see "NAMES AND ABBREVIATIONS"

                            Additional info like ESSID, TFS, IP address...

              The lower right box shows bar graphs for:

                     Signal of last received packet in green

                     bps    Bits per second of all received packets

                     Usage  Percentage of channel use

              The lower edge is the menu and status bar, it shows which keys
              to press for other screens. The status shows ">" when horst is
              running or "=" when it is paused, then "F" when any kind of
              filter is active, the Channel, the monitor interface in use and
              the time.

       Pause ('p' or <space>)

              Can be used to pause/resume horst. When horst is paused it will
              loose packets received in the mean time.

       Reset ('r')

              Clears all history and aggregated statistical data.

       History ('h')

              The history screen scrolls from right to left and shows a bar
              for each packet indicating the signal level. In the line below
              that, the packet type is indicated by one character (See NAMES
              AND ABBREVIATIONS below) and the rough physical data rate is
              indicated below that in blue.

       ESSID ('e')

              The ESSID screen groups information by ESSID and shows the mode
              (AP, IBSS), the MAC address of the sender, the BSSID, the TSF,
              the beacon interval, the channel, the signal, a "W" when
              encrytoion is used and the IP address if known.

       Statistics ('a')

              The statistics screen groups packets by physical rate and by
              packet type and shows other kinds of aggregated and statistical
              information based on packets.

       Spectrum Analyzer ('s')

              The "poor mans spectrum analyzer" screen is only really useful
              when horst is started with the -s option or the "Automatically
              change channel" option is selected in the "Chan" settings, or
              the config option channel_scan is set.

              It shows the available channels horizontally and vertical bars
              for each channel:

                     Signal in green

                     Physical rate in blue

                     Channel usage in orange/brown

       By pressing the 'n' key, the display can be changed to show only the
       average signal level on each channel and the last 4 digits of the MAC
       address of the individual nodes at the level (height) they were
       received. This can give a quick graphical overview of the distance of

       Filters ('f')

              This configuration dialog can be used to define the active

       Channel Settings ('c')

              This configuration dialog can be used to change the channel
              changing behaviour of horst or to change to a different channel

       Sort ('o')

              Only active in the main screen, can be used to sort the node
              list in the upper area by Signal, Time, BSSID or Channel.

       802.11 standard frames

                       Management frames
              a │ ASOCRQ │ Association request
              A │ ASOCRP │ Associaion response
              a │ REASRQ │ Reassociation request
              A │ REASRP │ Reassociation response
              p │ PROBRQ │ Probe request
              P │ PROBRP │ Probe response
              T │ TIMING │ Timing Advertisement
              B │ BEACON │ Beacon
              t │ ATIM   │ ATIM
              D │ DISASC │ Disassociation
              u │ AUTH   │ Authentication
              U │ DEAUTH │ Deauthentication
              C │ ACTION │ Action
              c │ ACTNOA │ Action No Ack

                      Control frames
              w │ CTWRAP │ Control Wrapper
              b │ BACKRQ │ Block Ack Request
              B │ BACK   │ Block Ack
              s │ PSPOLL │ PS-Poll
              R │ RTS    │ RTS
              C │ CTS    │ CTS
              K │ ACK    │ ACK
              f │ CFEND  │ CF-End
              f │ CFENDK │ CF-End + CF-Ack

                              Data frames
              D │ DATA   │ Data
              F │ DCFACK │ Data + CF-Ack
              F │ DCFPLL │ Data + CF-Poll
              F │ DCFKPL │ Data + CF-Ack + CF-Poll

              n │ NULL   │ Null (no data)
              f │ CFACK  │ CF-Ack (no data)
              f │ CFPOLL │ CF-Poll (no data)
              f │ CFCKPL │ CF-Ack + CF-Poll (no data)
              Q │ QDATA  │ QoS Data
              F │ QDCFCK │ QoS Data + CF-Ack
              F │ QDCFPL │ QoS Data + CF-Poll
              F │ QDCFKP │ QoS Data + CF-Ack + CF-Poll
              N │ QDNULL │ QoS Null (no data)
              f │ QCFPLL │ QoS CF-Poll (no data)
              f │ QCFKPL │ QoS CF-Ack + CF-Poll (no data)
              * │ BADFCS │ Bad frame checksum

       Packet types

              Similar to 802.11 frames above but higher level and as a bit
              field (types can overlap, e.g. DATA + IP) and including more
              information, like IP, ARP, BATMAN, OLSR...

                                       Packet types
              CTRL   │ 0x000001 │ WLAN Control frame
              MGMT   │ 0x000002 │ WLAN Management frame
              DATA   │ 0x000004 │ WLAN Data frame
              BADFCS │ 0x000008 │ WLAN frame checksum (FCS) bad
              BEACON │ 0x000010 │ WLAN beacon frame
              PROBE  │ 0x000020 │ WLAN probe request or response
              ASSOC  │ 0x000040 │ WLAN associaction request/response frame
              AUTH   │ 0x000080 │ WLAN authentication frame
              RTSCTS │ 0x000100 │ WLAN RTS or CTS
              ACK    │ 0x000200 │ WLAN ACK or BlockACK
              NULL   │ 0x000400 │ WLAN NULL Data frame
              QDATA  │ 0x000800 │ WLAN QoS Data frame (WME/WMM)
              ARP    │ 0x001000 │ ARP packet
              IP     │ 0x002000 │ IP packet
              ICMP   │ 0x004000 │ IP ICMP packet
              UDP    │ 0x008000 │ IP UDP
              TCP    │ 0x010000 │ IP TCP
              OLSR   │ 0x020000 │ OLSR protocol
              BATMAN │ 0x040000 │ BATMAND Layer3 or BATMAN-ADV Layer 2 frame
              MESHZ  │ 0x080000 │ MeshCruzer protocol

       Operating modes

              Bit field of operating mode type which is infered from received
              packets. Modes may overlap, i.e. it is common to see STA and PRB
              at the same time.

                            Operating modes
              AP      │ 0x01 │ Access Point (AP)
              ADH     │ 0x02 │ Ad-hoc node
              STA     │ 0x04 │ Station (AP client)
              PRB     │ 0x08 │ Sent PROBE requests
              WDS     │ 0x10 │ WDS or 4 Address frames
              UNKNOWN │ 0x20 │ Unknown e.g. RTS/CTS or ACK

       To capture and analyze 802.11 traffic, the interface needs to be in
       monitor mode. You can either setup the interface manually beforehand or
       let horst setup it automatically at startup. Usually, root privileges
       are required to modify an interface setup.

       horst should work with any wireleass LAN card and driver which supports
       monitor mode, with either "prism2" or "radiotap" headers. This includes
       most modern mac80211-based drivers.

       If the interface is not in monitor mode at startup, horst first tries
       to put the interface in monitor mode. If it fails (for example when the
       interface is already in use), a new virtual monitor interface (horst0)
       is added and used instead. The virtual monitor interface is removed
       when horst exits. Note that changing the channel via a virtual monitor
       interface is not allowed by the wireless driver, so options -C and -s
       do not work when virtual monitor interface is used.

       Examples of how to setup an interface manually:

       Using iw:
              iw wlan0 interface add mon0 type monitor


              sudo iw wlan1 set type monitor
              sudo iw wlan1 set channel 6

       Using iwconfig:
              iwconfig wlan0 mode monitor
              iwconfig wlan0 channel 1
              ifconfig wlan0 up

       Using madwifi:
              wlanconfig wlan0 create wlandev wifi0 wlanmode monitor

       Using hostap:
              iwconfig wlan0 mode monitor
              iwpriv wlan0 monitor_type 1

       Signal values and ranges may differ between wireless drivers and

       The format of the output file (-o flag) is a comma separated list of
       the following fields in the following order, one packet each line.

              Local time, including microseconds (e.g. 2015-05-16
              15:05:44.338806 +0300)

              802.11 MAC packet type name as defined in the section "NAMES AND

              Source MAC address

              Destination MAC address


              Higher level packet name as defined in section "NAMES AND

              Signal strength in dBm

              Packet length (MAC)

              Physical data rate

              Received while tuned to this frequency.

              TFS timer value

              ESSID, network name

              Operating modes as defined in "NAMES AND ABBREVIATIONS".

              Channel number

              Encryption in use

              WPA1 Encryption in use

              RSN (WPA2) Encryption in use

       ip_src IP source address (if available)

       ip_dst IP destionation address (if available)

       horst.conf(5), tcpdump(1), wireshark(1), kismet(1), README,

       horst was written by Bruno Randolf <br1@einfach.org>.

       This manual page was written by Antoine Beaupré <anarcat@debian.org>,
       for the Debian project (and may be used by others).

                                 July 22, 2015                        HORST(8)