yeet-src/airtop

airtop is a terminal dashboard for Linux that shows you what is happening with the Wi-Fi radio signals around you, in real time. Think of it like htop, the system process monitor, but instead of CPU and memory it displays nearby Wi-Fi access points, their signal strengths, and the types of wireless traffic the kernel is picking up. The tool reads 802.11 Wi-Fi frames directly from the Linux kernel using eBPF, a technology that lets programs attach to kernel functions without modifying the kernel itself. This means airtop works on your normal, connected Wi-Fi interface without switching into monitor mode or dropping your internet connection. No extra hardware or special card configuration is needed. When you run it, you get several live panels in the terminal. A frequency spectrum shows every access point plotted at its actual channel frequency, which reveals when multiple routers are competing on the same channel, the most common reason for slow Wi-Fi. A signal chart tracks each nearby device over time. A frame-type heatmap shows the mix of management, control, and data packets, and it highlights deauthentication floods instantly, which is the signature of a wireless deauth attack or a misbehaving router. An access point list ranks nearby networks by signal strength, and a signal histogram shows the overall shape of the RF environment around you. The practical uses are straightforward: figure out why a video call is stuttering due to channel congestion, check whether an access point is actually broadcasting before troubleshooting a connection, pick a clean channel before a presentation, or spot unexpected deauth traffic on a network. The tool counts frames rather than bytes, and it only sees the channel your radio is currently on, so it is not a full packet capture suite. For deep forensics you would still want a dedicated monitor-mode tool. Running airtop requires Linux with BTF kernel support (which ships by default on Ubuntu, Fedora, Arch, and Debian 12+), a standard Wi-Fi card, and the yeet runtime that handles the privileged kernel attachment. One curl command installs the runtime and two commands start the dashboard.