2KKUU7ita

Figure 9-12:
NetStumbler
showing
potentially
unauthorized
APs.
Look for the following rogue AP characteristics:
Chapter 9: Wireless LANs
✓ Odd SSIDs, including the popular default ones such as linksys and free wifi.
✓ Odd AP system names — that is, the name of the AP if your hardware
supports this feature. Not to be confused with the SSID.
✓ MAC addresses that don’t belong on your network. Look at the first
three bytes of the MAC address (the first six numbers), which specify
the vendor name. You can perform a MAC-address vendor lookup at
http://standards.ieee.org/develop/regauth/oui/public.
html to find information on APs you’re unsure of.
✓ Weak radio signals, which can indicate that an AP has been hidden away
or is adjacent to or even outside of your building.
✓ Communications across a different radio channel(s) than what your network
communicates on.
✓ Degradation in network throughput for any WLAN client.
In Figure 9-12, NetStumbler has found two potentially unauthorized APs.
The ones that stand out are the two with SSIDs of BI and LarsWorld. Notice
how they’re running on two different channels, two different speeds, and are
made by two different hardware vendors. If you know what’s supposed to
be running on your wireless network (you do, don’t you?), unauthorized systems
can really stand out.
NetStumbler does have one limitation: It won’t find APs that have probe
response (SSID broadcast) packets disabled. Commercial wireless network
analyzers such as CommView for WiFi as well as the open source Kismet look
not only for probe responses from APs like NetStumbler does, but also for
other 802.11 management packets, such as association responses and beacons.
This allows Kismet to detect the presence of hidden WLANs.
If the UNIX platform is not your cup of tea, and you’re still looking for a quick
and dirty way to root out hidden APs, you can create a client-to-AP reconnection
scenario that forces the broadcasting of SSIDs using de-authentication
packets. You can find detailed instructions in the book I wrote with Peter T.
Davis, Hacking Wireless Networks For Dummies.
173