802.11 Monitoring Tools

There are several different types of tools available. AP detection utilities scan all the 802.11b channels and report the SSIDs they find. Often they will report other statistics as well, such as WEP capabilities and signal strength.

True "&802.11 sniffers" are more sophisticated. They allow the user to see the actual traffic of all devices on the channel that are in range. These have the potential for abuse in the hands of those who would violate other's privacy.

Link Analysis tools show the signal strength and other parameters of the connection between a client and the AP. These are often bundled with the drivers for the client card.

Linux:

• How to sniff with the Cisco Aironet card (with Linux). Usefull but incomplete. I will be posting my own notes on this when I get the chance.
• Linux-Wlan-NG drivers by Absolute Value Systems are the standard drivers for prism2 cards under Linux. It includes the prismdump sniffer.
• Linux Host Mode AP drivers also include a program for sniffing.
• The newer versions of tcpdump also support 802.11 sniffing.
• The Ethereal sniffer supports 802.11 as well.
• Kismet is an 802.11 specific sniffer for linux, using cards of the Prism2 or Cisco Aironet families.

The myriad of tools available for linux, and their dependencies, can be confusing. Special patches may need to be applied to Ethereal and Tcpdump to enable 802.11 sniffing, and beta versions of libpcap may need to be installed. These procedures will shortly be documented here.

Microsoft Windows:

• AirSnort is a 98/ME/2K/XP program for AP detection. Works with Hermes (Lucent) cards only.

• ApSniff is a Windows 2000 program for AP detection. Works with Prism2 cards (tested with DWL-650 & Linksys cards).