How do I Monitor Wireless Traffic?
Wireless traffic is considered to be those Internet protocol packets that are transmitted through an 802.11a,b,g,n, or i wireless protocol.
Monitoring Requirements
There are a few things to consider when you plan to setup wireless traffic monitoring. First you need to determine what kind of traffic you are intending to monitor, to or from your local systems, or to and from a system you do not have direct control of. Second, you need to have the appropriate wireless adapter installed in your system, with its proper driver loaded. Thirdly, you need to have monitoring software in place on that system that can sniff packets on that interface.
Traffic Selection
If you are attempting to monitor traffic to and from a specific system you have administrative access to, then any sniffer capable of attaching to your local wireless interface is all that is necessary.
If you want to monitor traffic between systems you do not have administrative access to, you will need to ensure your wireless adapter has the ability to go into monitor mode. Wireless adapters placed in monitor mode do not normally operate for other connectvity at the same time, so if you use a wireless adapter for Internet access, you will need to have two wireless interfaces installed if you would like to maintain Internet connectivity while monitoring. You will need to place your system kernel in monitor mode in some cases previous to using ethereal. Check your adapter and operating system documentation to determine how to do this.
Wireless Adapters
Some wireless adapters are better suited to sniffing packets than others. Not all adapters can properly detect and report errors, and others have drivers that are not very suited to packet sniffing. Cisco Aironet cards, Prism II cards, and Orinaco Silver and Gold cards are considered to be the best cards to perform monitoring from, but they are only a few of many that have the capability and the proper drivers available. Research which cards are available for the operating system you are intending to use, and procedures necessary for their driver install before purchasing any card.
Wireless Sniffers
A free full-featured multi-platform sniffer which supports most wireless adapters is ethereal. This package is very suitable for debugging communications between systems and formats output in such a way to assist the user in identifying protocol components. It also provides additional information about those protocols that are not always available in other sniffers making it quite simple to use with limited training. You will still be required to understand the protocols you are debugging to get the full benefit of the sniffer output.
Airsnort is a wireless encryption key recovery program that allows you to determine what the lost or unknown encryption keys for your wirless devices are after you passively monitor packets for a period.
Another tool named Aircrack-ptw is similar to Airsnort, however, it has been more refined for determination of WEP keys, and can decode them in a much less time since it requires significantly fewer sniffed packets to do so.
Kismet is a wireless network detection tool that can also sniff packets and provide intrusion detection services if it is properly configured. Kismet is a very useful tool for conducting wireless network audits, as it has all the proper utilities required for performing audits.
Additional Equipment
It may be helpful to ensure you have better equipment to perform your monitoring duties. Equipment that may be useful for wireless network audits include :
Legal Concerns
Keep in mind that monitoring or otherwise auditing networks and systems you do not own may be illegal in your country or state. Consult legal counsel if you are unsure of the legal ramifications when performing any activities outside of your personal property.
|
|
|
Free White Papers on Networking
Vulnerability Management for Dummies
|
Our friends at Qualys are offering free copies of the electronic version of Vulnerability Management for Dummies to Tech-FAQ readers. Vulnerability Management for Dummies:
|
|
