• WirelessSniffer

Kindly hosted by:

More and more WirelessSniffers are becoming available. These could be quite useful. If you are aware of one that we don't have listed, know more about one then we do or have comments/thoughts about them please list them here.

Airscanner Mobile Sniffer for Pocket PC

Note: according to this website, this product has been discontinued but you may still be able to find it? AndrewCates (Free for personal use) An 802.11b Ethernet sniffer for the PocketPC. -- Sniff wireless packets in promiscuous mode -- Decode UDP, TCP, Ethernet, DNS, and NetBios packets -- Conduct network analysis on an entire WLAN segment -- Customize filters for source and/or destination IP Address, UDP Port, TCP Port, or MAC -- View real-time packet statistics -- Save results of capture sessions -- Export data to Ethereal format for further analysis on a desktop PC http://airscanner.com/downloads/sniffer/sniffer.html

WiFiFoFum

(free) 802.11b sniffer for pocketpc 2003 devices

just the same as every sniffer , play a noise when an AP is found etc etc also supports gps for small realtime (basic) maps

http://www.wififofum.org/

Open Source / Free

Airsnort (Linux / Windows 2000 / BSD?)

• http://airsnort.shmoo.com AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered. A beta version for Windows NT/2000 is provided at http://winairsnort.free.fr where source codes on MSVisual C++ are also available.

Airosniff by ninsei research labs (FreeBSD)

• http://gravitino.net/~bind/code/airosniff/ Airosniff can be used to assist in the identification of wireless networks by sniffing SSIDs. Airosniff, for the Cisco Aironet card allows one to seek out wireless networks, auto-config the card for sniffing and perform access point vendor identification.

  • I haven't actually used this yet as I don't have a Cisco card. but it looks interesting (and free). -- EliabHelon "FreeBSD Only!", from ~bind's home page -- DonPark

    • OT: check out http://gravitino.net/~aempirei. i know both of those guys, they're great. --AndrewWoods

Airview (Windows 2000 /Windows XP)

• http://airview.sourceforge.net/ Airview is designed for capturing and analyzing network packets on wireless 802.11a/b/g and TCP/UDP Ethernet networks. It gathers information from the wireless or LAN adapter and decodes the analyzed data. AirView does not need pre-installed packet capture drivers instead of other wireless sniffers. Network adapters supported : Wireless Wifi 802.11b - Ethernet (802.3) - Token-Ring - FDDI - WAN (modem). Airview is free for download and is open source ! Source code for Delphi is also available at Sourceforge at http://airview.sourceforge.net/.

APsniff (Windows)

• http://www.bretmounet.com/ApSniff/index.asp APsniff still has a few raw corners, but it's the first (and only) sniffer for Windows that works with Prism 2 cards (Linksys, D-Link, etc). -- ScottK

Aerosol (Windows)

• http://www.sec33.com/sniph/aerosol.php Aerosol is a relatively complaint well working Windows Sniffer for Prism 2 chipsets, seems to work a bit better than APsniff -- PanicOpticon

ClassicStumbler (Mac OS 8.5 to 9.2.2)

• http://www.alksoft.com/classicstumbler.html

ClassicStumbler is a Macintosh program which scans the airwaves for all Wi-Fi networks within range. It provides a graphical display of networks, their conditions, and detailed information including encryption status, signal and noise levels, and whether or not the network is ad-hoc. Connect to available networks from within the application. (Click ClassicStumbler for more info.)

iStumbler (Mac OS X)

• http://istumbler.net/

"iStumbler is a free, open source tool for finding wireless networks and devices with your AirPort or Bluetooth equipped Macintosh. iStumbler combines a compact user interface with a real time display of signal strength and complete debugging information"

BSD style license.

KisMAC (Mac OS X)

• http://www.binaervarianz.de/projekte/programmieren/kismac/

KisMAC is a stumbler application for MacOS X. It is full-featured and includes support for a lot of wireless cards.

Kismet (Linux and now Mac OS X)

• http://www.kismetwireless.net/ (old site: http://www.nerv-un.net/~dragorn/kismet/)

• This looks very cool. A curses based netstumbler. Looks like it has lots of good docs as well.

• I wrote up a little guide to getting kismet working with orinoco cards, which you can find at AshlandWireless:KismetOrinoco. --ForrestEnglish

MacStumbler (Mac OS X)

• http://www.macstumbler.com/

Wireless scanning tool for the Apple Airport. It is a Beta, but I have not had any problems with it. The new version logs signal strength. Very similar to iStumbler. GPL.

MiniStumbler (PocketPC)

• http://www.netstumbler.com

MiniStumbler is the Pocket PC version of NetStumbler, written by MariusMilner.

Mognet (Java/Linux)

• http://chocobospore.org/mognet/ Still in early beta but looks promising. Requires the latest libpcap (newer then 0.6.2) and the java libraries to interface to libpcap.

NetStumbler (Windows)

• http://www.netstumbler.com

• The de facto sniffer for Hermes based cards. -- MariusMilner

A french version is also available. See http://clorenz.free.fr

PocketWarrior (PocketPC)

• http://www.pocketwarrior.org/

This is wardriving software for PRISM that run on PocketPC 2002. Pocketwarrior is now released under GPL. Binaries for ARM,SH3 and MIPS available. Now supports GPS.

Prism2Dump (*BSD)

• http://www.dachb0den.com/projects/bsd-airtools.html

• http://www.seattlewireless.net/index.cgi/Prism2Dump

• This is a tool that puts a Prism2Card into the wireless equivalent of promiscuous mode. I believe there is a Linux version around somewhere as well but I'm not sure where. -- AdamShand

Prism Dump (??)

• http://developer.axis.com/software/tools/ ... Anyone got more info on this? I'm assuming this refers to the prismdump utility from Axis Communications, which "is a program intended for use with Intersil's PRISM-II based wireless LAN (WLAN) adapters and Ethereal (version 0.8.14 or later)". It captures 802.11 traffic and saves it in libpcap format, so the captures can be read by the current version of Ethereal (see above) and the 3.7 beta and current CVS versions of tcpdump (see below). -- Guy Harris ( guy@alum.mit.edu )

TCPDump (Linux or FreeBSD)

• http://www.tcpdump.org/ ... Install Linux and tcpdump on your computer. Run tcpdump. See all the network traffic of your wireless net. tcpdump doesn't care that it is a wireless net, so you only see the network traffic, not the 802.11 specific information. Works great.

  • My understanding is that this is not quite the same, the Linux box can only see what it can associate with and I'm not sure you get promiscuous mode. The wireless sniffers above will actually sniff everything that's out there and show you all the ESSID's and channels in use, signal strength etc. For straight IP debugging though tcpdump is a great cheap alternative. -- AdamShand

  True - You don't get all the same features that the commercial products offer. It only will give you information on networks that you associate with. However you can put the wireless network card into promiscuous mode and sniff all the IP traffic that is going across it, even between two other computers. Also even if the AP has MAC address security, you can still sniff the packets going across the network, you just can't send any packets out. (Tested with Mac Airport (Client), UGate 3300 AP in BSS Mode, and Linux Laptop with Lucent Gold Card) -- TerrySchmidt

  • The current CVS version of tcpdump (available from the www.tcpdump.org Web site), and the 3.7 and later versions, can dissect raw 802.11 packets; the current CVS, and 0.7 and later, versions of libpcap allow it (and Ethereal) to capture raw 802.11 packets on Linux and FreeBSD systems with the appropriate drivers (as per the comment in the section on Ethereal). -- Guy Harris ( guy@alum.mit.edu )

WiFi Analyzer (Android)

• http://sites.google.com/site/farproc/wifi-analyzer

• WiFi Analyzer will scan the 2.4Ghz band and show the SSIDs it can see, channels they are on and signal strength.

wifiscanner (Linux)

• http://www.hsc.fr/ressources/outils/wifiscanner/index.html.en "WifiScanner is an analyser/detector of 802.11b stations and acces points. It can listen alternatively on all the 14 channels, and write packets information in real time. Can search access points and associated client stations, and generate a graphic of the architecture using GraphViz (http://www.graphviz.org/)."

wavemon (Linux)

• http://www.jm-music.de/projects.html A text-mode/curses wireless utility. Shows basically all the iwconfig info in a screen that refreshes itself. It also has a histogram of signal strength and a list of in-range APs, although I have yet to see that feature work. Its the best text-mode way Ive seen of monitoring signal strength and thats what I use it for. -- DonPark wavemon 0.3.3 has problems with multiple wireless interfaces, the -i option is broken. A bug report has been submitted to the author. You can get a useful (but not as pretty) display by issuing the command 'watch "cat /proc/net/wireless"'.

Wellenreiter

• http://www.remote-exploit.org/projects.php Did you ever try to scan for any networks on the road. Try Wellenreiter. Wellenreiter is a gtkperl program that makes the discovery and the audit of 802.11b wireless-networks much easier. It has an embedded statistic engine for the common parameters provided by the wireless drivers which enables you to fetch the detail about the consistency and signal strength etc of the network.For discover accesspoints / networks / ad-hoc cards, Wellenreiter got an amazing easy scanner window. It searches for any accesspoint in the range of the scanning device. It detects and differs essid boradcasting or non-broadcasting wireless networks in every channel,doing frequency switching automatically. The manufactor is detected by the devices MAC-Address. WEP detection is also implemented and Wellenreiter detects and differs wherever the xx=== pong.exe (Windows) ===

• http://mobileaccess.de/wlan/?go=technik A security tool that unveils password, WEP-Keys, MAC addresses and more from most current 22MBit AccessPoints. You even don't have to know the IP of the AP. Simply connect to a WLan and there you go...

Wireshark (Windows, MacOS X, Linux, FreeBSD)

• http://www.wireshark.org/ Wireshark is a GUI sniffer which understands 802.11b, g, and n frames. WEP and WPA/WPA2 decryption is supported. Wireless capture is supported under Windows using the AirPcap adapter. Platform-specific notes on wireless capture can be found on the Wireshark wiki.

• Specific questions about wireless capture should be sent to wireshark-users@wireshark.org .

• See also the Kismet documentation at

• http://www.kismetwireless.net/documentation.shtml

• which also discusses how to coerce various OSes and drivers to run in "monitor mode".

WiStumbler (NetBSD)

• http://www.gongon.com/persons/iseki/wistumbler/index.html Network stumbler for WaveLAN/IEEE wireless networking of NetBSD.

wlandump (Linux-WLAN $0?)

• http://www.linux-wlan.com/ Details unknown. If anyone has more please add them.

WLAN Expert (Windows $0?)

• http://www.vector.kharkov.ua/download/WLAN/wlanexpert.zip More of a site survey tool then a true sniffer but pretty useful anyway. It only works with a stock Prism2Card.

Commercial

AirMagnet (~$2,500+)

• http://www.airmagnet.com/products.htm "AirMagnet Wireless Analyzers provide complete wireless administration solutions on a variety of platforms to conform to the different ways Network Professionals work." They have solutions for both laptops and handheld. The handheld works with Pocket PC, and goes for ?$2,495 MSRP? http://www.80211-planet.com/reviews/ST/article.php/1403641 (software only). They have a demo on their website.

Airopeek from Wild Packets (Windows $1495 on 14 April 2003)

• http://www.wildpackets.com/products/airopeek "Airopeek is a comprehensive packet analyzer for IEEE 802.11b wireless LANs, supporting all higher level network protocols such as TCP/IP, Appletalk, NetBEUI, and IPX. Affordable and easy-to-use, Airopeek contains all of the network troubleshooting features familiar to users of our award-winning Etherpeek. In addition, Airopeek quickly isolates security problems, fully decodes 802.11b WLAN protocols, and expertly analyzes wireless network performance with accurate identification of signal strength, channel and data rates."

  • I've been playing with this lately, and there's at least one caveat. Both 1.0 and 1.1 will work with LucOrinAvaya cards, provided you install their custom driver. However, 1.0 will not fully decode upper level protocols. All packets will only be displayed as their 802.11 types. --AndrewWoods

2.0 now available

AP Scanner ($5 for commercial use)

• http://homepage.mac.com/typexi/Personal1.html

• A basic sniffer for the Macintosh which will show you the activity on all channels and what ESSID's are bound to which channels.

Grasshopper from Berkeley Varitronics (~$2800)

• http://www.bvsystems.com/Products/WLAN/Grasshopper/grasshopper.htm

• http://lists.bawug.org/pipermail/wireless/2001-March/000540.html "Grasshopper[tm] is a handheld, wireless receiver designed specifically for sweeping and optimizing Local Area Networks. The instrument measures coverage of direct sequence CDMA networks which operate on the IEEE 802.11b standard allowing the user to measure and determine the AP (AccessPoint), PER (Packet Error Rate) and RSSI signal levels aiding in locating the hub and access points throughout a building. Grasshopper detects and differentiates from narrow-band multipath interferences such as microwave ovens and frequency hopping systems and features a built-in display, keypad and removable battery pack for true portability."

Sniffer Wireless from Network Associates (Windows $10,000's)

• http://www.sniffer.com/products/wireless/default.asp?A=5 "Sniffer Wireless was designed in accordance with the IEEE 802.11b interoperability standard. It includes network monitoring, capturing, decoding, and filtering-all the standard award-winning Sniffer Pro features you already know and appreciate. Sniffer Wireless also provides the most comprehensive 802.11b solution to the unique aspects of wireless networks. Sniffer Wireless is the industry-first Wireless LAN management tool that can spot security risks in real-time, identify network problems efficiently and reduce network-operating costs."

  • Sniffer Wireless has the worst interface of any sniffer of any variety that I've ever used. 100% menu driven; you cannot double-click or right-click on anything to drill into anything else. Filters also need to be manually entered and cannot be created on the fly. It is not possible to view live packet streams; all analysis must be done on saved captures. On top of that, to get Sniffer's Wireless offering, you must first license software sniffer for over $20,000. That said, it does collect and report on some obscure RF metrics. -- (9/9/02 Jim Kirby) I agree, Sniffer has a horrible interface, and it's too expensive. I have used both this and Aeropeek. Aeropeek is a better solution. (James Berry 11/02)

Where have you been living? Are you still using the DOS version of Sniffer? The 4.5 and newer is the best it has ever been, you can double click and you can create filters on the fly. Even better is that 4.8 that came out this month (Dec 02) is the ONLY 802.11A sniffer around. (Tom Simpson 12/02) I don't leave home without it.

Teletronics 2MB & 11MB Card and Utility Software (<$100.00)

• Contact Rick Lindahl at rickl@invictusnetworks.com or 503-635-2562

  • Teletronics has a nice color coded bar graph type, realtime monitor for watching 2.4GHz activity in a given area. It works only on their 2 & 11meg cards By using directional and/or omnidirectional antennas you can see how much RF activity is in a given area. Very inexpensive and quite functional for initial site surveys (updated 12-31-01 RickLindahl)

Sniff-em (~$115)

• Contact support@yasc.net | http://www.sniff-em.com

• Sniff'em™ is a competitively priced, performance minded Windows based Packet sniffer, Network analyzer and Network sniffer, a new network management tool designed from the ground up with ease and functionality in mind. Sniff-em can capture WiFi frames from the top layer only.

• Sniff-em Trial download

Isomair Wireless Sentry ($)

• Contact info@isomair.com , or +44(0)20-7940-0077

• Isomair provide a wireless scanning device, the Wireless Sentry. This innovative product offers intrusion detection, auditing, performance management and many other advanced features. In addition the Wireless Sentry can be used for remote packet capture in enterprise wireless network environments. The device is intended to be infrequently moved, and provides permanent visibility of your wireless networks and remote controlled packet capture features. No more walking around your buildings looking for wireless networks, and highly cost effective remote data capture, avaliable now!

NetChaser (formerly WiFinder), (PalmOS/Tungsten C) Shareware $10

• Bits n Bolts http://www.bitsnbolts.com

• Handy and feature packed. Logs finds, stamps with GPS if attached, shows Signal, WEP, ESSID as well as MAC, Last Seen and a few more bits of info. Saves logs on poweroff or exiting. Logs are in CSV for use in other programs. Works great on the Tungsten C, though lots of use will drain your battery, so have a car charger handy if your wardriving. -- TomHiggins

• Turn on the "Blank screen while scanning" option under "Advanced Settings" and the batteries last quite a while. I did two hours of scanning and only got down to 78% battery charge. In addition, I get pretty acceptable range. Currently, only runs on a Palm Tungsten C (which rule, btw) --jgw

Packet Sniffer SDK for Windows (VCL, DLL, ActiveX, and static libs for VC/Borland C)

Packet Sniffer SDK (PSSDK) library set is the most powerful component suite for network packet capture in Windows OS family environment. No pre-installed packet drivers are required;Packet Sniffer SDK supports all modern development environments for Windows; Using Packet Sniffer SDK the developer does not need to create special network drivers or to learn internal implementation of the network functionalities in all Windows family operating systems.

• Download trial version Download

• Packet Sniffer SDK for Windows http://microolap.com/r?event1=shareit_out&event2=214180&event3=Packet+Sniffer+SDK+(Single+License+With+1+Year+Update+Subscription)&goto=https://secure.element5.com/register.html?productid=214180&language=English&HADDITIONAL1[214180=#EVENT_GID# Buy]

XEDO AIR SNIFFER

Free for private usage, commercial usage $ 199,00

Award winning WLAN Sniffer with many features.

---

• [CategorySoftware]