Note: “horst” is moving to GitHub: https://github.com/br101/horst! This information here is just kept for reference during the transition! Please read the new documentation on GitHub and create issues there!

“horst” is a small, lightweight IEEE802.11 wireless LAN analyzer with a text interface. Its basic function is similar to tcpdump, Wireshark or Kismet, but it’s much smaller and shows different, aggregated information which is not easily available from other tools. It is mainly targeted at debugging wireless LANs with a focus on ad-hoc (IBSS) mode in larger mesh networks. It can be useful to get a quick overview of what’s going on on all wireless LAN channels and to identify problems.

  • Shows signal (RSSI) values per station
  • Calculates channel utilization (“usage”) by adding up the amount of time the packets actually occupy the medium
  • “Spectrum Analyzer” shows signal levels and usage per channel
  • Graphical packet history, with signal, packet type and physical rate
  • Shows all stations per ESSID and the live TSF per node as it is counting
  • Detects IBSS “splits” (same ESSID but different BSSID – this is a common driver problem)
  • Statistics of packets/bytes per physical rate and per packet type
  • Has some support for mesh protocols (OLSR and batman)
  • Can filter specific packet types, source addresses or BSSIDs
  • Client/server support for monitoring on remote nodes

“horst” is a Linux program and can be used on any wireless LAN monitor interface. The latest version is 4.2 from Oct 1 2014.




If you want to support my independent development of horst, please donate some dollars or euros via PayPal:

Usage notes

With most standard Linux (mac80211) drivers you can use the ‘iw’ command to add a monitor interface while you can continue to use the existing interface:

iw wlan0 interface add mon0 type monitor

Please note that while the main interface (wlan0) is connected, the wifi driver does not allow horst to change the channel because it would disrupt connectivity. This is one of the main FAQ on horst. If you want horst to be able to change channels (horst -s or “channel_scan” option) you need to have only monitor interfaces. This is how to set an existing interface to monitor mode and a specific channel:

iw wlan0 set type monitor
ifconfig wlan0 up
iw wlan0 set channel 6

If you need to use the deprecated WEXT interface can put the interface into monitor mode like this:

iwconfig wlan0 mode monitor channel X

After you have your card in monitor mode you can start horst as root:

sudo horst -i mon0

To use the client/server mode to do remote monitoring over the network you can start a server (-q without a user interface) with

horst -i wlan0 -C -q

and connect a client with

horst -c IP

Only one client is allowed at a time.

To go straight into “Spectrum Analyzer” mode (please see the above notes about changing channels) you can start horst with -s:

horst -s

Please read the man page for more details about the output and abbreviations. It should be be part of your distribution package, but you can do this in the source code locally with:

man -l horst.1


Version 4.3 (not yet released!)

  • Added support for configuration file
  • Renamed command line options: -C is now -N for network server mode, and -c is -n for  network client. -c is used for specifying the configuration file now.
  • -x multiple commands now have to be separated by “;” instead of “:”
  • Support 3 digit channel numbers (upper 5GHz band)

Version 4.2 (1.10.2014)

  • Fixed current Usage and thruput status bars
  • Added -u option for setting the upper channel limit

Version 4.1 (26.09.2014)

  • Removed SNR and Noise, since there is no reliably way to get these on a per-packet basis. Now just work with the Signal (RSSI) values the driver reports, as that’s all we really have.
  • Added -D option for full debug output
  • Bugfix “signed char” for ARM platforms
  • Bugfix for channel flags
  • Bugfix for false IBSS split detection for APs

Version 4.0 (01.08.2014)

  • Added 802.11n support (MCS rates, packet types)
  • Added batman-adv support (v14)
  • Added named pipe as control interface (-X -x)
  • Added Mode filter option (-m)
  • Added Packet filter option (-o)
  • Add man page
  • Show but otherwise ignore frames with bad FCS
  • Show ESSID and WPA status for stations
  • WPA and RSN parsing and display
  • Improved formatting of main node list
  • Review of 802.11-2012 packet types
  • Improved Radiotap parsing using radiotap.org library
  • Handle SIGTERM and SIGHUP
  • Support compilation on Mac OSX
  • More robust ESSID string handling
  • Fixed parallel building
  • Fixed “stack smashing” bug
  • Fixed window resizing bug
  • Fixed quiet mode (-q)


Please contact me at (br1 at einfach dot org) if you have any problems or questions. New feature ideas, patches and feedback is always welcome. Rudimentary support for Mac OSX and other BSD clones can be achieved by compiling with make PCAP=1, but this is not tested much.

git clone git://br1.einfach.org/horst

Please create GitHub issues or send e-mail for problem reports and support, instead of posting comments below!


  1. andrey says:

    Hello, Bruno,

    Thank you very much for a great tool!
    I have a question about getting the channel on which a probe response was sent. In the UI there is a channel for each probe response frame, but when I send output to the file, some of them have ’0′ as a channel. I’ve searched a little bit and found that channel is reported in DS Parameter Set field. And seems like it’s optional. So where do you get the channel number in the UI from?
    Thanks in advance!

  2. Raviv says:


    I’m using horst for a research project, and it works great, Thanks!
    I’m facing an issue with the channel usage measurements ( packet duration ). i get usage of above 100%.
    From my testings ( with iperf ) i can guess that each 10M represents 60 %. which means :
    10M –> 60%
    20M –> 120%
    30M —> 180%

    Can you explain what’s wrong ?


  3. megha says:

    i’m using openwrt wifi router. is this HORST is compatible to my router. and even i need the each and every step for downloading and installing this software can u give it to me.

  4. peoplenn says:

    Hi, is it possible to print the results of horsts in stdout to parse them and process them?


  5. I’ve just added horst as net-wireless/horst to Gentoo/Linux main package repository. Keep up the good work!