Sniff Wi-Fi

Readers of this blog may have noticed that my frequency of blogging has waned in 2011, so it's time for some self-motivation. I'm going to start a series of blog posts titled, "Three Things I Like" and apply to all sorts of WiFi (and possibly even some non-WiFi) topics. I'm going to start with a darned good WiFi sniffer, Fluke Networks' AirMagnet WiFi Analyzer. AirMagnet WiFi Analyzer from Fluke Networks has long been the leading WiFi protocol analyzer by market share . It has also long been one of my favorite tools to use when helping others learn about WiFi. Here are three things that I like about AirMagnet WiFi Analyzer. Pre-made device filters.  When you navigate to the Infrastructure screen (fourth icon from the left in the navigation menu that sits in the far lower left hand corner of the screen), any time you click on an access point (AP) or station, the software immediately starts showing you statistics on frames that are traveling to or from ...

Last Sunday I took a flight equipped with Gogo in-flight WiFi so that I could work in an office with guest WiFi. The difference in security was stark, and Gogo should make changes to fix their poor (and, in my opinion, negligent) WiFi security. Gogo in-flight WiFi  is a service that I've blogged about before, but I feel compelled to mention it again because the security problems I complained about a year and a half ago are still there even as hacking knowledge and applications have grown. To recap Gogo's poor security design: Open System authentication with no encryption is used for Gogo's WiFi security. This means that applications like Firesheep  allow hackers to do sidejacking attacks, like the one that seems to have been performed on Ashton Kutcher recently.  Captive Portal authentication is used to charge passengers for Internet access. This means that anyone who knows how to spoof a MAC address  (link is for XP, but the same can be done in Vista/Win7 vi...

The CWDP Study Guide was recently released. The certification is valuable and the study guide is great as a reference, but as a book it is just about unreadable. Certified Wireless Design Professional ( CWDP ) is a new certification from the CWNP Program, a group that creates and manages vendor-neutral WLAN certifications. The CWNP Program has long had a Certified Wireless Network Administrator (CWNA) and Certified Wireless Security Professional (CWSP) certifications, and here in 2011 they are adding the CWDP and Certified Wireless Analysis Professional (CWAP) certifications. The spirit of these certifications is that WiFi professionals often work in very specific disciplines, so the CWNP Program has a certification track for most industry professionals. Work for an equipment vendor? You probably want CWAP. An integrator? Probably CWDP. The NSA? CPP . (I jest, I jest. And if any NSA people read this blog, let me request the pain-free truth serum in advance.) The CWDP exam is th...

It should come as no surprise that many WiFi-enabled mobile phones sometimes exhibit behavior that makes them vulnerable to attack. In at least one case, you can use a WiFi sniffer to view such behavior so that the proper changes can be made to your phone. When a WiFi device associates to an access point, it must first go through the process of Discovery so that it can decide which AP is best (based on SSID, signal strength, etc.). Discovery is done either by listening for Beacon frames or transmitting Probe Request frames in hopes of eliciting a Probe Response frame. The Discovery process reveals the same information about an access point (SSID, channel, rates, security, etc.) whether it is through a Beacon or a Probe Response, it's just that the probing process can be faster because the station can initiate it at any time. The problem with the Probe Request/Response sequence is that it could lead to an attack. Hackers running sniffing software (for the types of nefarious pur...

UFC 125 happened on New Year's Day, and I was fortunate enough to cover the show for the Wrestling Observer . As with just about every sporting event nowadays, the MGM Grand Garden Arena provided WiFi service for the members of the media who were covering the event. I managed to squeeze in a little bit of sniffing while I was doing my live blog , and the results I found were a little bit surprising to me. When I think of public Wi-Fi, I think of downloads. Maybe that makes me an old codger, but I just imagine all of these web pages, videos and spam emails coming down with just a few requests and acknowledgments going back up. The world has changed, of course, with more people than ever wanting to tweet, blog and upload photos as part of the social media revolution, but I still was dubious when Andrew Von Nagy ( @revolutionwifi ) told me on Twitter that I should expect a pretty even distribution of data on any public WiFi network nowadays. Sniffing in the media area turned out t...

A common conundrum for enterprise WLAN administrators is guest access. You often want or need to provide it, but you want to make sure the guest WiFi has a minimal effect on the internal network. One way that people try to limit guest access is by specifying low speeds, but that is a bad idea that usually causes the internal WiFi to be worse off than it should be. I was doing some work at a hotel in the Chicagoland area recently when I came upon another example of bad guest WiFi. Bad guest WiFi is quite common, but this one was avoidable. I've seen bad guest WiFi because of under-covered areas and because of over-covered areas. I've seen some guest WLANs with  over-saturation of stations and others with under-saturation of broadband. As with any WiFi design, there is a little bit of art in the science. You have to look at numbers like signal-to-noise ratio and users-per-channel but in the spaces where desired numbers collide, the owner of the WLAN has to make good choices ...

In life, the opposite side of intellectualism is sometimes a good place to be. Analyzing a WLAN is not one of those times. When someone tells you that a boring movie is great because it was shot well or that a nil-nil draw in football (world, not American) was thrilling because of all the close chances, the best idea is often to sit back, draw a creamy bowl of vanilla ice cream and tell that nerd that you don't need a P.H.D. to know what makes you happy. This type of anti-intellectualism is almost certainly born as a rebellion against deep analysis (perhaps making the rest of this blog post intrinsically ironic). Sometimes, though, deep analysis is needed to prevent festering problems from bubbling over at bad times. It takes no great insight to point out that there is a penalty to eschewing analysis. The man who  avoids Oscar-bait movies may miss a work of great emotional power. Disregarding scoreless football matches would have caused fans to miss the most thrilling match of th...