wig-ng
open-sourceThe section your link pointed to isn't on wig-ng's page any more, so we've brought you to the top.
wig-ng is a free and open source utility for WiFi device fingerprinting supporting protocols including WPS, WiFi-Direct, CCX, AWDL, and HP Printers.
Summary
wig-ng is an open-source command-line utility for WiFi device fingerprinting, free to use and installed via pip. It runs against a wireless interface in monitor mode or against saved pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. captures, parsing protocols like WPS, WiFi-Direct, CCX, AWDL, and HP printer information elements to identify devices on a network. This makes it a fit for wireless security testers and red teamers doing WiFi recon, rather than a general web or host scanner; the README notes it deliberately skips channel hopping, expecting it to be paired with tools like airodump-ng or chopping. It sits in the wireless reconnaissance space alongside those capture and channel-hopping utilities. Started in 2019 with three contributors and one release in the tracked window, it has seen no commits in the past year, so treat it as dormant rather than actively maintained.
wig-ng is a free and open source utility for WiFi device fingerprinting supporting protocols including WPS, WiFi-Direct, CCX, AWDL, and HP Printers.
How wig-ng helps
Which devices nearby are exposing WPS or WiFi-Direct that would otherwise look like anonymous MAC addresses?
reads the vendor-specific and standard information elements in the captured frames and ties them to fingerprints for WPS, WiFi-Direct, CCX, AWDL, and HP printer protocols, naming the device type or model behind the beacon
What kind of hardware is actually on this network's air, beyond what a channel dump shows?
parses the same information elements out of a pcap and reports the protocol-level details a plain capture tool leaves as raw bytes
Can I get a device inventory from a capture I already took, without re-running the scan live?
takes a saved pcap file or a whole directory of them as input and produces the same fingerprinting output it would from a live monitor-mode interface
Have I already seen this device on a different capture from earlier in the engagement?
processing multiple pcap files against the same protocol fingerprints lets matching devices across separate captures be recognized by their WPS, CCX, or AWDL identifiers rather than just their MAC
Is a target device willing to respond to frames I send it, not just what it broadcasts passively?
active mode injects frames for the modules that support it, drawing out responses that passive listening on a monitor interface would never surface
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Release-note detail over time
See how much detail wig-ng puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
Nothing shipped since we started watching. Releases and docs updates land here as they happen.
Project health
Issue, contributor and maintainer activity in 6e726d/wig-ng, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 0 ±0 vs prior 12 months
- Maintainers 0 +0 joined · −0 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 1 of 2 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 1
- Contributors / month 0
- Commits / month 0
- Stars 40
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →