Wireless activity collection

The optional Linux.80211 agent source passively collects Wi-Fi beacons, probe requests, and probe responses. Use it to explore wireless activity on networks you administer, alongside other host and network telemetry.

Requirements

• 64-bit Linux and a dedicated monitor-capable wireless adapter.
• iw, iproute2, and libpcap, with root privileges or the required network administration and raw capture capabilities.
• A separate interface for uploads. The capture adapter changes to monitor mode and must not be managed by a network manager or supplicant.

For the full configuration, container permissions, and recovery procedure, see the agent repository's wireless collection example.

Explore observations

With the source enabled and records arriving in its default schema:

Linux.80211.Management
| where timestamp > ago(1h)
| summarize observations = count() by FrameType
| render barchart

Available fields include observed MAC addresses, frame type, frequency, channel, and signal level when supplied by the adapter. These are reception observations, not precise locations or reliable physical-device identities. MAC randomization, channel hopping, and capture losses limit what can be inferred.

The source can retain raw MAC addresses and SSIDs. Choose collection scope and retention appropriate for the network, and avoid publishing raw observations in a public demo.