> ## Content Index
> Fetch the complete content index at: https://connortumbleson.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Setting up Nzyme
- URL: https://connortumbleson.com/2022/04/25/setting-up-nzyme/
- Published: 2022-04-25T02:30:00.000Z
- Updated: 2025-05-09T14:32:13.000Z
- Description: A tool to help up the game in the security of WiFi networks - meet nzyme.
- Author: Connor Tumbleson
- Tags: Security

![](https://connortumbleson.com/content/images/2022/04/nzyme-home-1.png)

[nzyme home](https://www.nzyme.org/?ref=connortumbleson.com)

A couple months ago I was at a talk when I learned about a piece of software that is common in home labs. I listened to a [talk](https://t.co/FCDsLU2LZS?ref=connortumbleson.com) by Vodkanaut and he demoed Nzyme and it looked quite interesting, so I spent some time setting up the project as well.

The project in short is a forensic piece of software for WiFi networks. It can log frames and compare to signatures and patterns to provide a constant source of updates of the state of your wireless network. It was built by [Lennart Koopmann](https://github.com/lennartkoopmann/nzyme?ref=connortumbleson.com) who was the name behind Graylog2.

The documentation on the project website [guides you through](https://www.nzyme.org/docs/installation-configuration/install-raspberry-pi-os?ref=connortumbleson.com) the installation and you can follow that without an issue. So I decided to buy a new Raspberry Pi 4 and a [Panda Wireless PAU09 N600](https://amzn.to/3Oq8NIW?ref=connortumbleson.com) \- this is [one of the devices](https://www.nzyme.org/docs/installation-configuration/requirements?ref=connortumbleson.com#required-one-or-more-wifi-adapters-that-support-monitor-mode-on-your-operating-system) that is recommended as being able to support monitor mode and working with the project.

One thing I encountered that I highly recommend doing is setting up [predictable interface names](https://www.nzyme.org/docs/installation-configuration/predictable-interfaces?ref=connortumbleson.com). As described, this moves things like `wlan0` to something consistent for that device like `wlp1s0u1u2`. This helps so you can ensure you are talking to the right adapter that supports monitor mode vs the inline wireless that is common on most Pi's.

```
wlan0     IEEE 802.11  ESSID:off/any  
          Mode:Managed  Access Point: Not-Associated   Tx-Power=31 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:on
          
wlp1s0u1u2  IEEE 802.11  Mode:Monitor  Frequency:2.484 GHz  Tx-Power=20 dBm   
          Retry short  long limit:2   RTS thr:off   Fragment thr:off
          Power Management:off
```

As the documentation suggests, you may run into some problems having `libpcap` automatically configure monitor mode like I did. This means I manually configured my device to keep it in monitor mode, then told nzyme to not worry about it.

```json
802_11_monitors: [
  {
    # The 802.11/WiFi adapter name. (from `ifconfig` or `ip link`)
    device: wlp1s0u1u2

    # WiFi interface and 802.11 channels to use. Nzyme will cycle your network adapters through these channels.
    # Consider local legal requirements and regulations.
    # See also: https://en.wikipedia.org/wiki/List_of_WLAN_channels
    channels: [1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,38,40,42,44,46,48,50,52,54,56,58,60,62,64,100,102,104]

    # There is no way for nzyme to configure your wifi interface directly. We are using direct operating system commands to
    # configure the adapter. Examples for Linux are in the documentation.
    channel_hop_command: "sudo /sbin/iwconfig {interface} channel {channel}"

    # Channel hop interval in seconds. Leave at default if you don't know what this is.
    channel_hop_interval: 1

    # Time this monitor can remain without recording any frames until it is marked as failing. Under certain conditions,
    # it can be normal to not record any frames for an extended period of time. If you receive warnings and alerts for
    # failed probes when there were simply no frames to record, increase this value. Default: 60
    max_idle_time_seconds: 60

    # Skip the automatic monitor mode configuration of this interface. Only enable this if for some reason libpcap can't
    # properly configure this interface into monitor mode. In that case, you can try to set it manually instead.
    skip_enable_monitor: true
  }
]
```

`/etc/nzyme/nzyme.conf`

So knowing that the automatic configuration of `libpcap` wasn't quite working, I leveraged a network config file at the system level and then set `skip_enable_monitor` above to `true`.

```shell
root@raspberrypi:/home/pi# cat /etc/network/interfaces.d/wlp1s0u1u2 
auto wlp1s0u1u2
iface wlp1s0u1u2 inet manual
 wireless-mode monitor
```

These changes paired together got my external adapter in monitor mode, surviving reboots and booting up with nzyme successfully.

So now it was time to setup a nightly email to send me a report of my network. 

![](https://connortumbleson.com/content/images/2022/04/report-weekly.png)

Weekly nzyme Tactical Summary

So I get a cool email that shows me:

- Alert count
- Health check
- Status of all networks seen in past 24 hours
- Any new networks
- Any new alert/tracker detected

Now nzyme even shines when you decide to monitor a network, so I monitor my home network (`xb0x`).

![](https://connortumbleson.com/content/images/2022/04/network-detail-1.png)

![](https://connortumbleson.com/content/images/2022/04/network-detail-2.png)

/network/show page in nzyme

This is probably more paranoia than anything, but I can really see into my network to see if anyone else is attempting to deauth me and/or replicate my network with a spoofed one.

On top of specifically monitoring a network - I can globally listen to a growing list of signatures that recognize unique devices. This would basically be devices built by HAK5 or a [Pwnagotchi](https://connortumbleson.com/2022/02/07/the-pwnagotchi/).

So I turned on my Pwnagotchi and waited a few moments until it popped up as an active alert (`PWNAGOTCHI_ADVERTISEMENT`) in nzyme.

![](https://connortumbleson.com/content/images/2022/04/pwn-nzyme.png)

nzyme - pwnagotchi alarm

So now I have a cool little peace of mind if anyone is trying some clever network attacks near my home network.

The project is [open source](https://github.com/lennartkoopmann/nzyme?ref=connortumbleson.com) and looks to be growing with a new major UI refresh designed as "2.0.0". The current version I'm running is 1.2.2 so I'm excited to see what a refreshed interface looks like.