More and more WirelessSniffers are becoming available. These could be quite useful. If you are aware of one that we don't have listed, know more about one then we do or have comments/thoughts about them please list them here.
Airscanner Mobile Sniffer for Pocket PC
(Free for personal use) An 802.11b Ethernet sniffer for the PocketPC. -- Sniff wireless packets in promiscuous mode -- Decode UDP, TCP, Ethernet, DNS, and NetBios packets -- Conduct network analysis on an entire WLAN segment -- Customize filters for source and/or destination IP Address, UDP Port, TCP Port, or MAC -- View real-time packet statistics -- Save results of capture sessions -- Export data to Ethereal format for further analysis on a desktop PC http://airscanner.com/downloads/sniffer/sniffer.html
Open Source / Free
Airsnort (Linux / Windows 2000 / BSD?)
http://airsnort.shmoo.com AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered. A beta version for Windows NT/2000 is provided at http://clorenz.free.fr where source codes on MSVisual C++ are also available.
Airosniff by ninsei research labs (FreeBSD)
http://gravitino.net/~bind/code/airosniff/ Airosniff can be used to assist in the identification of wireless networks by sniffing SSIDs. Airosniff, for the Cisco Aironet card allows one to seek out wireless networks, auto-config the card for sniffing and perform access point vendor identification.
I haven't actually used this yet as I don't have a Cisco card. but it looks interesting (and free). -- EliabHelon "FreeBSD Only!", from ~bind's home page -- DonPark
OT: check out http://gravitino.net/~aempirei. i know both of those guys, they're great. --AndrewWoods
APsniff (Windows)
http://www.bretmounet.com/ApSniff/index.asp APsniff still has a few raw corners, but it's the first (and only) sniffer for Windows that works with Prism 2 cards (Linksys, D-Link, etc). -- ScottK
Aerosol (Windows)
http://www.sec33.com/sniph/aerosol.php Aerosol is a relatively complaint well working Windows Sniffer for Prism 2 chipsets, seems to work a bit better than APsniff -- PanicOpticon
Ethereal (Linux, FreeBSD)
http://www.ethereal.com/ Ethereal is a GUI sniffer which understands 802.11b frames. Unfortunately right now the only way to get wireless frames into Ethereal is to use Linux 2.4.6 (or custom patches to 2.2.19) or the latest bleeding edge FreeBSD (version ??) and patches to Libpcap (or the current CVS version, or 0.7 or later version, from tcpdump.org; see below) and BPF. Ethereal works great under Free BSD 2.5, which is stable. It is in the ports directory (2/14/2002 Rich Gibson).
- cd /usr/ports/net/ethereal
- (as root) make install clean
- rehash
- ethereal - pick your interface, wi0, and Bob's your uncle.
Presumably by "FreeBSD 2.5" you mean FreeBSD *4*.5 - 2.5 is *really* old.
For reasonably current information about wireless sniffing in Ethereal see
http://www.ethereal.com/faq.html#raw_80211_sniff
which is subject to change over time as more information is provided to us (mail updates to ethereal-users@ethereal.com) and as software changes.
See also the Kismet documentation at
http://www.kismetwireless.net/documentation.shtml
which also discusses how to coerce various OSes and drivers to run in "monitor mode".
Note that, whilst Ethereal runs on a number of OSes, the only ones on which it's currently known to support wireless monitor mode sniffing are Linux (with the right cards and drivers) and FreeBSD (with the right cards and OS version), although it might be possible to do so with at least some cards in current CVS NetBSD as well.
iStumbler (Mac OS X)
"iStumbler combines a compact Aqua user interface with advanced wireless scanning and reporting." Very similar to MacStumbler. BSD style licence.
KisMAC (Mac OS X)
KisMAC is a stumbler application for MacOS X, that puts your card into the monitor mode. For that purpose we are using the viha driver. Unlike other applications we are completely invisible and send no probe requests.
Kismet (Linux and now Mac OS X)
http://www.kismetwireless.net/ (old site: http://www.nerv-un.net/~dragorn/kismet/)
- This looks very cool. A curses based netstumbler. Looks like it has lots of good docs as well.
I wrote up a little guide to getting kismet working with orinoco cards, which you can find at AshlandWireless:KismetOrinoco. --ForrestEnglish
MacStumbler (Mac OS X)
Wireless scanning tool for the Apple Airport. It is a Beta, but I have not had any problems with it. The new version logs signal strength. Very similar to iStumbler. GPL.
MiniStumbler (PocketPC)
MiniStumbler is the Pocket PC version of NetStumbler, written by MariusMilner.
Mognet (Java/Linux)
http://chocobospore.org/mognet/ Still in early beta but looks promising. Requires the latest libpcap (newer then 0.6.2) and the java libraries to interface to libpcap.
NetStumbler (Windows)
The de facto sniffer for Hermes based cards. -- MariusMilner
A french version is also available. See http://clorenz.free.fr
PocketWarrior (PocketPC)
This is wardriving software for PRISM that run on PocketPC 2002. Pocketwarrior is now released under GPL. Binaries for ARM,SH3 and MIPS available. Now supports GPS.
Prism2Dump (*BSD)
This is a tool that puts a Prism2Card into the wireless equivelent of promiscuous mode. I believe there is a Linux version around somewhere as well but I'm not sure where. -- AdamShand
Prism Dump (??)
http://developer.axis.com/software/tools/ ... Anyone got more info on this?
I'm assuming this refers to the prismdump utility from Axis Communications, which "is a program intended for use with Intersil's PRISM-II based wireless LAN (WLAN) adapters and Ethereal (version 0.8.14 or later)". It captures 802.11 traffic and saves it in libpcap format, so the captures can be read by the current version of Ethereal (see above) and the 3.7 beta and current CVS versions of tcpdump (see below). -- Guy Harris (guy@alum.mit.edu)
TCPDump (Linux or FreeBSD)
http://www.tcpdump.org/ ... Install Linux and tcpdump on your computer. Run tcpdump. See all the network traffic of your wireless net. tcpdump doesn't care that it is a wireless net, so you only see the network traffic, not the 802.11 specific information. Works great.
My understanding is that this is not quite the same, the Linux box can only see what it can associate with and I'm not sure you get promiscuous mode. The wireless sniffers above will actually sniff everything that's out there and show you all the ESSID's and channels in use, signal strength etc. For straight IP debugging though tcpdump is a great cheap alternative. -- AdamShand
True - You don't get all the same features that the commercial products offer. It only will give you information on networks that you associate with. However you can put the wireless network card into promiscous mode and sniff all the IP traffic that is going across it, even between two other computers. Also even if the AP has MAC address security, you can still sniff the packets going across the network, you just can't send any packets out. (Tested with Mac Airport (Client), UGate 3300 AP in BSS Mode, and Linux Laptop with Lucent Gold Card) -- TerrySchmidt
The current CVS version of tcpdump (available from the www.tcpdump.org Web site), and the 3.7 and later versions, can dissect raw 802.11 packets; the current CVS, and 0.7 and later, versions of libpcap allow it (and Ethereal) to capture raw 802.11 packets on Linux and FreeBSD systems with the appropriate drivers (as per the comment in the section on Ethereal). -- Guy Harris (guy@alum.mit.edu)
wavemon (Linux)
http://www.jm-music.de/projects.html A text-mode/curses wireless utility. Shows basically all the iwconfig info in a screen that refreshes itself. It also has a histogram of signal strength and a list of in-range APs, although I have yet to see that feature work. Its the best text-mode way Ive seen of monitoring signal strength and thats what I use it for. -- DonPark wavemon 0.3.3 has problems with multiple wireless interfaces, the -i option is broken. A bug report has been submitted to the author. You can get a useful (but not as pretty) display by issuing the command 'watch "cat /proc/net/wireless"'.
Wellenreiter
http://www.remote-exploit.org/projects.php Did you ever try to scan for any networks on the road. Try Wellenreiter. Wellenreiter is a gtkperl program that makes the discovery and the audit of 802.11b wireless-networks much easier. It has an embedded statistic engine for the common parameters provided by the wireless drivers which enables you to fetch the detail about the consistency and signal strength etc of the network.For discover accesspoints / networks / ad-hoc cards, Wellenreiter got an amazing easy scanner window. It searches for any accesspoint in the range of the scanning device. It detects and differs essid boradcasting or non-broadcasting wireless networks in every channel,doing frequency switching automaticly. The manufactor is detected by the devices MAC-Address. WEP detection is also implemented and Wellenreiter detects and differs wherever the beacon broadcasting machine is an true accesspoint or an AD-Hoc mode station.
pong.exe (Windows)
http://mobileaccess.de/wlan/?go=technik A security tool that unveils password, WEP-Keys, MAC addresses and more from most current 22MBit AccessPoints. You even don't have to know the IP of the AP. Simply connect to a WLan and there you go...
WiStumbler (NetBSD)
http://www.gongon.com/persons/iseki/wistumbler/index.html Network stumbler for WaveLAN/IEEE wireless networking of NetBSD.
wlandump (Linux-WLAN $0?)
http://www.linux-wlan.com/ Details unknown. If anyone has more please add them.
WLAN Expert (Windows $0?)
http://www.vector.kharkov.ua/download/WLAN/wlanexpert.zip More of a site survey tool then a true sniffer but pretty useful anyway. It only works with a stock Prism2Card.
Commercial
AirMagnet (~$2,500+)
http://www.airmagnet.com/products.htm "AirMagnet Wireless Analyzers provide complete wireless administration solutions on a variety of platforms to conform to the different ways Network Professionals work."
They have solutions for both laptops and handheld. The handheld works with Pocket PC, and goes for ?$2,495 MSRP? http://www.80211-planet.com/reviews/ST/article.php/1403641 (software only). They have a demo on their website.
Airopeek from Wild Packets (Windows $1495 on 14 April 2003)
http://www.wildpackets.com/products/airopeek "Airopeek is a comprehensive packet analyzer for IEEE 802.11b wireless LANs, supporting all higher level network protocols such as TCP/IP, Appletalk, NetBEUI, and IPX. Affordable and easy-to-use, Airopeek contains all of the network troubleshooting features familiar to users of our award-winning Etherpeek. In addition, Airopeek quickly isolates security problems, fully decodes 802.11b WLAN protocols, and expertly analyzes wireless network performance with accurate identification of signal strength, channel and data rates."
I've been playing with this lately, and there's at least one caveat. Both 1.0 and 1.1 will work with LucOrinAvaya cards, provided you install their custom [http://www.wildpackets.com/support/hardware/ap_lucent_driver driver]. However, 1.0 will not fully decode upper level protocols. All packets will only be displayed as their 802.11 types. --AndrewWoods
1.2 now available
AP Scanner ($5 for comercial use)
- A basic sniffer for the Macintosh which will show you the activity on all channels and what ESSID's are bound to which channels.
Grasshopper from Berkeley Varitronics (~$2800)
http://www.bvsystems.com/Products/WLAN/Grasshopper/grasshopper.htm
http://lists.bawug.org/pipermail/wireless/2001-March/000540.html "Grasshopper[tm] is a handheld, wireless receiver designed specifically for sweeping and optimizing Local Area Networks. The instrument measures coverage of direct sequence CDMA networks which operate on the IEEE 802.11b standard allowing the user to measure and determine the AP (AccessPoint), PER (Packet Error Rate) and RSSI signal levels aiding in locating the hub and access points throughout a building. Grasshopper detects and differentiates from narrow-band multipath interferences such as microwave ovens and frequency hopping systems and features a built-in display, keypad and removable battery pack for true portability."
Sniffer Wireless from Network Associates (Windows $10,000's)
http://www.sniffer.com/products/wireless/default.asp?A=5 "Sniffer Wireless was designed in accordance with the IEEE 802.11b interoperability standard. It includes network monitoring, capturing, decoding, and filtering-all the standard award-winning Sniffer Pro features you already know and appreciate. Sniffer Wireless also provides the most comprehensive 802.11b solution to the unique aspects of wireless networks. Sniffer Wireless is the industry-first Wireless LAN management tool that can spot security risks in real-time, identify network problems efficiently and reduce network-operating costs."
- Sniffer Wireless has the worst interface of any sniffer of any variety that I've ever used. 100% menu driven; you cannot double-click or right-click on anything to drill into anything else. Filters also need to be manually entered and cannot be created on the fly. It is not possible to view live packet streams; all analysis must be done on saved captures. On top of that, to get Sniffer's Wireless offering, you must first license software sniffer for over $20,000. That said, it does collect and report on some obscure RF metrics. -- (9/9/02 Jim Kirby) I agree, Sniffer has a horrible interface, and it's too expensive. I have used both this and Aeropeek. Aeropeek is a better solution. (James Berry 11/02)
Where have you been living? Are you still using the DOS version of Sniffer? The 4.5 and newer is the best it has ever been, you can double click and you can create filters on the fly. Even better is that 4.8 that came out this month (Dec 02) is the ONLY 802.11A sniffer around. (Tom Simpson 12/02) I don't leave home without it.
Teletronics 2MB & 11MB Card and Utility Software (<$100.00)
Contact Rick Lindahl at rickl@invictusnetworks.com or 503-635-2562
Teletronics has a nice color coded bar graph type, realtime monitor for watching 2.4GHz activity in a given area. It works only on their 2 & 11meg cards By using directional and/or omnidirectional antennas you can see how much RF activity is in a given area. Very inexpensive and quite functional for initial site surveys (updated 12-31-01 RickLindahl)
Isomair Wireless Sentry ($)
* Contact info@isomair.com, or +44(0)20-7940-0077
- Isomair provide a wireless scanning device, the Wireless Sentry. This innovative product offers intrusion detection, auditing, performance management and many other advanced features. In addition the Wireless Sentry can be used for remote packet capture in enterprise wireless network environments. The device is intended to be infrequently moved, and provides permanent visibility of your wireless networks and remote controlled packet capture features. No more walking around your buildings looking for wireless networks, and highly cost effective remote data capture, avaliable now!
NetChaser (formerly Wifinder), Shareware $10
* Bits n Bolts http://www.bitsnbolts.com
Handy and feature packed. Logs finds, stamps with GPS if attached, shows Signal, WEP, ESSID as well as MAC, Last Seen and a few more bits of info. Saves logs on poweroff or exiting. Logs are in CSV for use in other programs. Works great on the Tungsten C, though lots of use will drain your battery, so have a car charger handy if your wardriving. -- TomHiggins
Turn on the "Blank screen while scanning" option under "Advanced Settings" and the batteries last quite a while. I did two hours of scanning and only got down to 78% battery charge. In addition, I get pretty acceptable range. Currently, only runs on a Palm Tungsten C (which rule, btw) --[http://absent.org/~jgw jgw]
[CategorySoftware] _