NewsFactor Network | Powerful Wireless Security Tools for Free

Powerful Wireless Security Tools for Free
By Vincent Ryan

August 20, 2003 4:00AM

Digg It!

For a network administrator or curious end-user looking to do basic sniffing of the airwaves for WLAN traffic and locations, Kismet, NetStumbler and AirSnort have a price that's hard to beat.

Despite the best efforts of developers and standards bodies, wireless LANs (WLANs) are still the poster child for unsecured networks. Wireless network-security

protocols contain enormous loopholes, coverage areas leak like a broken faucet, and many administrators do not even bother to turn on the security features that come with their systems.

As a result, for many network managers, security is still in the Stone Age. So, simple things like analyzing network traffic, detecting rogue access points, and determining the network's coverage area are vital tasks. Fortunately, there are many good tools for performing those functions, and three popular ones -- Kismet, NetStumbler and AirSnort -- are available as freeware.

Are these three programs capable tools that can help IT managers in their quest to rein in WLAN security? Maybe, and maybe not.

Raw Packet Reporter

First up is Kismet, which works both as a tool to find unknown networks and as a stationary monitoring system for a known network, Mike Kershaw, author of Kismet, told NewsFactor.

Kismet is different from other wireless network detectors. Most work by querying the firmware of the card to see what networks are in the area that will let the card join them, Kershaw said. Instead, Kismet collects all the packets in the air at any given time and dissects them to identify each network. "This lets Kismet detect networks with hidden SSIDs [Service Set Identifiers]," he noted, "and given time, discover the hidden SSIDs as users join the network."

If a GPS is available, Kismet can log the coordinates of every packet seen. It comes with a utility called "gpsmap" to plot the data graphically on downloaded maps, Kershaw said.

Kismet works with every wireless card that supports raw packet monitoring mode (rfmon) in Linux and a "decent selection" of cards on other operating systems, such as OpenBSD and Mac OSX, Kershaw said.

A Looking Glass

According to Kershaw, there are two main groups of users of Kismet: mobile users who use it for wardriving, or site auditing, to discover new networks and map locations; and stationary users who deploy Kismet as a monitoring and IDS system for their own networks.

Kismet is designed to be as modular as possible, he noted. It provides Layer-2 IDS features, and if it is told the WEP keys for a network, it can be linked to Snort to create a wireless Layer-2 and Layer-3 IDS system. "To help with this, Kismet "remote drones" can be run on low-end boxes throughout the building," he explained, "gathering wireless packets and sending them over the wired network to a central logger/processor ." (continued...)

1 | 2 | 3 | Next Page >