Review of The Hak5 WiFi Coconut – How to Use and is it Worth the Money?

The Wifi Coconut is a WiFi sniffer capable of concurrently monitoring the complete 2.4 GHz airspace.

A Wi-Fi sniffer that can monitor the entire spectrum brings a significant advantage by providing a holistic view of all wireless activities occurring within the 2.4 GHz range. This capability stands in contrast to the conventional approach of channel hopping, where a regular WiFi sniffer can only listen to one channel at a time. This limitation of channel-specific sniffers can potentially lead to missing out on crucial data present on other channels, making the full-spectrum sniffer a more comprehensive and effective tool

2.4 GHz Airspace

Wi-Fi functions by transmitting data through radio waves, and conventional networks typically operate within either the 2.4 GHz or 5 GHz frequency bands. Networks at 2.4 GHz offer extended coverage but might not perform as efficiently at close distances. Both network types have their own benefits and are widely used. The 2.4 GHz networks encompass 14 channels, each with a width of 22 MHz. Devices utilize various channels for communication, with channels 1, 6, and 11 being particularly common due to their lack of overlap. This becomes noticeable as you use tools like WiFi coconut, where a significant portion of traffic flows through these specific channels.

Conventional Wi-Fi adapters, such as the Alfa, possess a single built-in radio that hops across different channels to capture traffic. However, this design constraint limits their capability to focus on just one channel at any given time. The WiFi coconut stands out due to its distinctiveness: it features 14 dedicated built-in radios, each assigned to a unique channel. This configuration enables it to simultaneously capture data from every channel, making it a versatile tool for comprehensive traffic monitoring.

Why Can’t I Use My Computers WiFi Adapter?

Our computers come equipped with built-in WiFi adapters that allow us to connect to the internet. These adapters are integrated into our motherboard systems. However, when it comes to using these built-in adapters for WiFi sniffing, certain limitations become apparent. While these adapters are capable of interacting with WiFi networks, they might lack the essential features and functionalities needed to proficiently capture and analyze WiFi traffic for activities like packet sniffing, network monitoring, or security assessments.

For effective WiFi sniffing, an adapter capable of comprehensively listening to all network traffic is required, not solely the traffic intended for our specific device. Hardware WiFi adapters can be configured to enter a “monitor” mode, which permits them to capture all network activity on a given channel, regardless of the intended recipient. Most standard network adapters do not support this specialized mode.

Beyond this, dedicated WiFi adapters offer additional advantages. They possess superior range and sensitivity when it comes to capturing WiFi signals. This elevated capability allows for more precise packet capture and wider coverage distance. WiFi sniffing hinges on meticulous timing and coordination to accurately capture packets. Dedicated adapters are fine-tuned for this specific purpose, reducing susceptibility to interference or performance impediments that might impact standard network adapters.

How to Use the Wifi Coconut?

The Wifi Coconut is extremely easy to use and is compatible with Linux, macOS, and Windows. There were no issues installing the dependencies and configuring the device on my Kali Linux machine, which was a breath of fresh air as some of the other wifi adapters I have used have caused some headaches. First was to install the dependencies:

sudo apt install build-essential cmake libusb-1.0-0-dev libpcap-dev git

Then checkout the code via hak5’s github:

git clone https://github.com/hak5/hak5-wifi-coconut

Configuring the build:

cd hak5-wifi-coconut
mkdir build
cd build
cmake ../
make
make install

And finally run the WiFI Coconut software:

sudo wifi_coconut

There are a few cool options to play around with like customizing the LED functions, but most importantly the software integrates into tools like Wireshark and Kismet. The WiFi Coconut stores the packets in PCAP file and can be used to pipe the live packets directly into Tshark to perform real time packet analysis.

My Thoughts

For $200 this is without a doubt a cool little gadget and I am happy I was able to get one. The simplicity to get this device working was a breath of fresh air as so many wireless adapters have compatibility issues. This is a passive WiFi reconnaissance tool used for capturing and analyzing existing network traffic without actively interacting with the network, so your expectations should be based on what the device can actually do. It does not share the same functionalities as a tool like the WiFi Pineapple which has the ability to broadcast its own rogue access points and interact with devices connecting to it.

It’s a bit of a letdown that the WiFi Coconut is limited to the 2.4 GHz channel, especially since the 5 GHz channel is gaining popularity. However, it’s still an impressive little device that can simultaneously monitor all 14 channels. What really makes the WiFi Coconut stand out is that it doesn’t have much competition. While there are plenty of WiFi adapters out there, most rely on channel hopping to cover all the channels. The WiFi Coconut essentially acts like a dedicated listen-only router, capturing every bit of traffic nearby. Considering what it can do, this little device is pretty awesome. If you manage to get your hands on one, you’re in for a lot of fun experimenting with it.