[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-82231":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":16,"stars7d":17,"stars30d":18,"stars90d":15,"forks30d":15,"starsTrendScore":19,"compositeScore":20,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":21,"fork":21,"defaultBranch":22,"hasWiki":23,"hasPages":21,"topics":24,"createdAt":10,"pushedAt":10,"updatedAt":33,"readmeContent":34,"aiSummary":35,"trendingCount":15,"starSnapshotCount":15,"syncStatus":36,"lastSyncTime":37,"discoverSource":38},82231,"airtop","yeet-src\u002Fairtop","yeet-src","htop for the airwaves — a live 802.11 (Wi-Fi) RF dashboard in your terminal","https:\u002F\u002Fyeet.cx",null,"JavaScript",51,1,26,0,12,19,22,36,0.9,false,"master",true,[25,26,27,28,29,30,31,32],"802-11","bpf","ebpf","network-monitoring","rf","terminal","tui","wifi","2026-06-12 02:04:24","# airtop\n\n**htop for the airwaves** — a live 802.11 (Wi-Fi) RF dashboard in your terminal.\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatform-Linux-1793D1\" alt=\"Linux\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fbuilt%20with-yeet%20%2B%20eBPF-8A2BE2\" alt=\"yeet + eBPF\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-GPL-3DA639\" alt=\"GPL\">\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fairtop.gif\" alt=\"airtop running in anonymize mode\" width=\"820\">\n\u003C\u002Fp>\n\n**airtop turns the Wi-Fi traffic around you into a live terminal dashboard** — a frequency spectrum of nearby access points, per-station signal traces, a frame-type activity feed, an RSSI histogram, and a rolling list of discovered networks — drawn with braille and block graphics over eBPF.\n\n> [!TIP]\n> **No monitor mode, no raw sockets.** airtop attaches eBPF programs to `mac80211`\u002F`cfg80211` and reads 802.11 frames as they flow through the kernel's Wi-Fi stack, so it runs on your normal, connected interface without dropping your link.\n\n## Quick start\n\n```sh\ncurl -fsSL https:\u002F\u002Fyeet.cx | sh\nyeet run https:\u002F\u002Fgithub.com\u002Fyeet-src\u002Fairtop\n```\n\nFor a shareable screenshot, anonymize SSIDs and MACs (your network and your neighbors' get relabeled `network-01`, `station-02`, …):\n\n```sh\nyeet run https:\u002F\u002Fgithub.com\u002Fyeet-src\u002Fairtop -- --anonymize\n```\n\nRuns until `Ctrl-C`. Resize the terminal and the layout reflows; minimum 80×24.\n\nTo surface neighboring networks the kernel needs scan results. Your OS scans periodically on its own, or force one:\n\n```sh\nnmcli dev wifi rescan        # or: iw dev \u003Ciface> scan\n```\n\n## A 60-second 802.11 primer\n\nWi-Fi is the IEEE 802.11 family of standards. The mental model:\n\n**Everything is a frame.** Your laptop, phone, and router exchange short radio packets called frames. Every frame carries MAC addresses, and one of them (the **BSSID**) identifies the access point it belongs to.\n\n**Three classes of frame:**\n\n| Class | Examples | Purpose |\n|---|---|---|\n| Management | Beacon, Probe, Auth, Assoc, Deauth | advertise, join, and leave networks |\n| Control | ACK, RTS\u002FCTS | coordinate who gets to talk |\n| Data | your actual traffic | carry payloads |\n\n**Access points beacon.** An AP announces itself ~10 times a second with a beacon frame carrying its network name (SSID) and BSSID. That's how your phone's Wi-Fi list gets populated, and how airtop discovers APs.\n\n**Channels & frequency.** Wi-Fi lives in bands (2.4 GHz, 5 GHz, 6 GHz), each split into channels, and every channel is a center frequency in MHz (channel 6 ≈ 2437 MHz, channel 161 ≈ 5805 MHz). A radio listens to one channel at a time, which is why you mostly see traffic on your channel.\n\n**Signal strength (RSSI)** is measured in dBm. Values are always negative, and closer to zero is stronger:\n\n| RSSI | quality |\n|---|---|\n| −30 … −50 dBm | excellent (right next to it) |\n| −50 … −67 dBm | good |\n| −67 … −80 dBm | usable |\n| −80 … −90 dBm | weak \u002F marginal |\n\n## Common use cases\n\nMostly home users debugging flaky Wi-Fi, and netadmins picking channels before an event.\n\n- Your video call stutters. Is your channel congested?\n- A guest can't connect. Is the AP even beaconing?\n- Picking a channel for a demo. What's the RF environment look like?\n- Deauth frames spike. Attack, or misbehaving router?\n\n## What you're looking at\n\nEach panel maps onto the concepts above:\n\n**Header** — uptime, total frames seen, live stations, discovered APs, beacon count, deauth count (red if any non-zero), and your current channel. The deauth counter is the one to keep an eye on; healthy networks have zero.\n\n**Frequency spectrum** — every discovered AP drawn as a signal \"hump\" positioned at its real center frequency on a MHz axis. Height and color show RSSI; the label is the SSID + dBm. **Overlapping humps reveal co-channel congestion** — the classic Wi-Fi-analyzer view, and the answer to \"why is my Wi-Fi slow.\"\n\n**RSSI × time** — a braille line graph per live station plotting its signal over the last several seconds. Watch a link fade as a device walks away from the AP, or jump when someone moves their laptop.\n\n**Frame feed** — a heatmap of frame types over time; cell color = how many of that type arrived per slice. **A deauth flood lights up that row instantly**, which is the alert pattern you actually want.\n\n**Signal histogram** — distribution of received frames by RSSI. The \"shape\" of your RF environment: a tight peak around −50 dBm means you're close to one strong AP, a smear across −60 to −80 means a crowded environment.\n\n**Access points** — discovered SSIDs with channel, signal gauge, and dBm, sorted strongest-first.\n\n## How it works\n\nA single BPF object (`airtop.bpf.c`) attaches two `fentry` programs and streams events to userspace over ring buffers:\n\n| Hook | What it captures |\n|---|---|\n| `fentry\u002Fieee80211_rx_list` | every received 802.11 frame: type\u002Fsubtype, addresses, RSSI from `ieee80211_rx_status` |\n| `fentry\u002Fcfg80211_inform_bss_frame_data` | every AP the kernel's scans discover: SSID, channel, signal |\n\nThe dashboard runs in yeet's V8 runtime, subscribing to those ring buffers and rendering the terminal UI:\n\n```\nmain.js       entry: tty size, render loop, BPF bind\u002Fsubscribe\nstate.js      live data + frame\u002Fscan ingest\nrender.js     ANSI, color ramps, braille canvas\u002Fcharts (pure)\ndashboard.js  panels + layout (renderDashboard)\n```\n\n## Requirements\n\n> [!IMPORTANT]\n> Linux with BTF: `CONFIG_DEBUG_INFO_BTF=y` and `CONFIG_DEBUG_INFO_BTF_MODULES=y`. Default on current Arch, Fedora, Ubuntu, and Debian 12+. CO-RE means no per-kernel recompile.\n\n- A Wi-Fi interface using the standard `cfg80211`\u002F`mac80211` stack (any normal Wi-Fi card on Linux).\n- The yeet daemon, which handles the privileged BPF load. `curl -fsSL https:\u002F\u002Fyeet.cx | sh` installs it.\n\n## Honest caveats\n\n> [!NOTE]\n> What airtop doesn't do:\n\n- A connected interface only hears its own channel plus whatever brief scans touch, so the spectrum and AP list fill in as scans run, and live per-frame traffic is mostly your channel. A full-band survey would need monitor mode + channel hopping.\n- It counts frames, not bytes. \"Activity\" is frame count, not airtime.\n- TX rate and retries aren't captured. That's a separate `tx_status` hook.\n- The `fentry` targets are stable in practice but not a kernel ABI; exact data depends on your Wi-Fi driver.\n\n## Community questions\n\n**Does this need monitor mode?**\nNo. That's the whole point. airtop hooks the kernel's Wi-Fi stack from inside, so it works on your normal connected interface.\n\n**Will it drop my connection?**\nNo. There's no mode switch; your interface stays associated to whatever it's associated to. airtop is observing what the kernel is already doing.\n\n**Why do I only see one or two networks?**\nBecause your radio is listening to one channel (its own) most of the time. Neighboring networks show up when your OS does periodic scans, or when you force one with `nmcli dev wifi rescan` \u002F `iw dev \u003Ciface> scan`. A full-band survey needs monitor mode + channel hopping, which is a different tool.\n\n**Is this legal?**\nPassively observing 802.11 frames in the air around you is legal in most jurisdictions; your radio is already receiving them, and airtop just shows you what's there. Active interference (the deauth panel *detects* attacks, it doesn't perform them) is a different story. If you're on a corporate network, check your AUP.\n\n**How is this different from Kismet, airodump-ng, or Wireshark?**\nThose tools do more with monitor mode: full per-frame capture, PCAP export, decryption. airtop runs on your normal interface and gives you an at-a-glance dashboard. For pen-testing, use airodump-ng. To find out why your call dropped, use this.\n\n## Building from source\n\n```sh\nmake          # generates include\u002Fvmlinux.h, builds bin\u002Fairtop.bpf.o\nmake vmlinux  # force-refresh the kernel type header\nmake clean\n```\n\nNeeds `clang` (BPF target) and `bpftool`; your distro's `libbpf` \u002F `libbpf-dev` for headers. The generated `include\u002Fvmlinux.h` and `bin\u002F` are gitignored.\n\n## Recording the demo\n\nThe GIF is produced with [VHS](https:\u002F\u002Fgithub.com\u002Fcharmbracelet\u002Fvhs) from `assets\u002Fairtop.tape`:\n\n```sh\nvhs assets\u002Fairtop.tape    # -> assets\u002Fairtop.gif\n```\n\nIt launches airtop off-camera so the GIF opens on the live dashboard. Kick off Wi-Fi scans in another shell while recording to fill the spectrum and AP list.\n\n## License\n\nThe BPF program is GPL (`SEC(\"license\") = \"GPL\"`), as required by the kernel helpers it uses.\n\n---\n\nBuilt by [yeet](https:\u002F\u002Fyeet.cx). yeet is a Linux runtime for writing eBPF programs and live system dashboards in JavaScript.\n","airtop 是一个用于实时监控802.11（Wi-Fi）无线信号的终端仪表盘。它利用eBPF技术直接从内核的Wi-Fi堆栈中读取数据帧，无需进入监听模式或使用原始套接字，即可在普通连接接口上运行。核心功能包括显示附近接入点的频谱、每个站点的信号轨迹、帧类型活动流、RSSI直方图以及发现网络的滚动列表，并通过盲文和块图形绘制界面。适合家庭用户排查Wi-Fi连接问题或网络管理员进行无线网络监控时使用。",2,"2026-06-11 04:08:07","CREATED_QUERY"]