is there a monitor - like Netstumbler - that can report back on what
encryption type is being used ?
ie - we can see an AP on a site survey,
but want to log what encryption it is using.... and most tools just report
everything as WEP.
--
----------------------------------
"If everything seems to be going well,
you have obviously overlooked something." - Steven Wright
On Mon, 23 Feb 2009 21:15:08 -0600, "ps56k"
<pschuman_no_spam_me@interserv.com> wrote:
>is there a monitor - like Netstumbler - that can report back on what
>encryption type is being used ?
>ie - we can see an AP on a site survey,
>but want to log what encryption it is using.... and most tools just report
>everything as WEP.
WiFi-Hopper shows the encryption type:
<http://wifihopper.com>
<http://wifihopper.com/screenshots.html>
The free version doesn't have the connection manager, but everything
else works.
"Jeff Liebermann" <jeffl@cruzio.com> wrote in message
news:9tv6q45e06umqami3b5tsev75cl1rvu72h@4ax.com...
> On Mon, 23 Feb 2009 21:15:08 -0600, "ps56k"
> <pschuman_no_spam_me@interserv.com> wrote:
>
>>is there a monitor - like Netstumbler - that can report back on what
>>encryption type is being used ?
>>ie - we can see an AP on a site survey,
>>but want to log what encryption it is using.... and most tools just report
>>everything as WEP.
>
> WiFi-Hopper shows the encryption type:
> <http://wifihopper.com>
> <http://wifihopper.com/screenshots.html>
> The free version doesn't have the connection manager, but everything
> else works.
>
tnx - found some other threads that mentioned it -
downloaded, and will try it out tomorrow .
On Tue, 24 Feb 2009 00:28:47 -0600, "ps56k"
<pschuman_no_spam_me@interserv.com> wrote:
>
>"Jeff Liebermann" <jeffl@cruzio.com> wrote in message
>news:9tv6q45e06umqami3b5tsev75cl1rvu72h@4ax.com.. .
>> On Mon, 23 Feb 2009 21:15:08 -0600, "ps56k"
>> <pschuman_no_spam_me@interserv.com> wrote:
>>
>>>is there a monitor - like Netstumbler - that can report back on what
>>>encryption type is being used ?
>>>ie - we can see an AP on a site survey,
>>>but want to log what encryption it is using.... and most tools just report
>>>everything as WEP.
>>
>> WiFi-Hopper shows the encryption type:
>> <http://wifihopper.com>
>> <http://wifihopper.com/screenshots.html>
>> The free version doesn't have the connection manager, but everything
>> else works.
>tnx - found some other threads that mentioned it -
>downloaded, and will try it out tomorrow .
The down side with WiFiHopper is that it installs a network driver
shim, which seems to screw up other sniffers. I haven't done much
testing or tinkering. The problems seem to go away when I disable the
shim, but I don't recall for sure. Just a warning if you run into
problems.
> The down side with WiFiHopper is that it installs a network driver
> shim, which seems to screw up other sniffers. I haven't done much
> testing or tinkering. The problems seem to go away when I disable the
> shim, but I don't recall for sure. Just a warning if you run into
> problems.
>
>
For ages I have been blaming XP updates for the deterioration in
Netstumbler performance as both Inssider and WiFiHopper both report the
same information without any problems.
After reading your post I uninstalled all 3 programs, checked the
windows/sys32 was clear of anything connected to them and reinstalled
Netstumbler and still have the same problem of it reporting only half of
the AP's and giving only the MAC address instead of the SSID for some of
those it sees.
I have decided to give up on Netstumbler on this XP SP2 machine and
stick with Inssider and Wifihopper.
I have been looking at some widgets for Vista this morning and while
having a browse on the Xirrus website I notice they have a new wifi tool
called "Xirrus Wi-Fi Inspector"
<http://www.xirrus.com/library/wifitools.php>
It seems to work quite well but it requires a bit more play before I
decide whether I will keep it.
On Wed, 25 Feb 2009 10:46:17 +0000, LR <lrme@privacy.net> wrote:
>On 25/02/2009 05:14, Jeff Liebermann wrote:
>
>> The down side with WiFiHopper is that it installs a network driver
>> shim, which seems to screw up other sniffers. I haven't done much
>> testing or tinkering. The problems seem to go away when I disable the
>> shim, but I don't recall for sure. Just a warning if you run into
>> problems.
I once posted a list of possible Netstumbler replacements in another
newsgroup:
<http://groups.google.com/group/ba.internet/msg/4e99b69e44ef08a3>
<http://groups.google.com/group/ba.internet/msg/f66c7adb2595eb34>
>For ages I have been blaming XP updates for the deterioration in
>Netstumbler performance as both Inssider and WiFiHopper both report the
>same information without any problems.
Yep. If I want to seem more radios, I use Kismet, which also picks up
wireless clients. Using a Linux liveCD, I can usually see more AP's
than with Netstumbler on the exact same machine. Weird.
> I have decided to give up on Netstumbler on this XP SP2 machine and
>stick with Inssider and Wifihopper.
Try a Linux LiveCD setup for sniffing:
<http://www.remote-exploit.org/backtrack.html>
<http://wiki.remote-exploit.org>
Version 3 final works well. I haven't tried Version 4 beta yet.
854MBytes to download. Ugh.
> Try a Linux LiveCD setup for sniffing:
> <http://www.remote-exploit.org/backtrack.html>
> <http://wiki.remote-exploit.org>
> Version 3 final works well. I haven't tried Version 4 beta yet.
> 854MBytes to download. Ugh.
Don't bother, I gave the 4 beta a try last weekend and wasn't impressed
from the wireless aspect. I still use the ver.2 as well as ver.3 but I
have never been able to get "wicrawl" to accurately report the channels
although "Midnight Research" say it was a known bug and was supposedly
fixed.
On 26/02/2009 08:37, LR wrote:
> On 26/02/2009 00:17, Jeff Liebermann wrote:
>
>> Try a Linux LiveCD setup for sniffing:
>> <http://www.remote-exploit.org/backtrack.html>
>> <http://wiki.remote-exploit.org>
>> Version 3 final works well. I haven't tried Version 4 beta yet.
>> 854MBytes to download. Ugh.
>
> Don't bother, I gave the 4 beta a try last weekend and wasn't impressed
> from the wireless aspect. I still use the ver.2 as well as ver.3 but I
> have never been able to get "wicrawl" to accurately report the channels
> although "Midnight Research" say it was a known bug and was supposedly
> fixed.
Should have added that when running the 4 beta and using Kismet I get a
third of the AP's showing compared to running kismet in Ubuntu using the
same RT2500 Chipset wireless card.
> I once posted a list of possible Netstumbler replacements in another
> newsgroup:
> <http://groups.google.com/group/ba.internet/msg/4e99b69e44ef08a3>
I will apologise for not reading all your post before replying.
With regards to "Vistumbler" as my vista machine is running AVG8 there
is a problem whereby AVG flags newer versions of the "vistumbler.exe"
file as a "worm/AUTOIT.PKW" and neither AVG nor the authors of
vistumbler have resolved this issue.
While it is possible to disable the resident shield, then install
Vistumbler and then create exception paths I don't really consider it
worthwhile.
I do have a version of Vistumbler installed which has no problems with
AVG and it is the 7.43 beta version.
On Thu, 26 Feb 2009 09:17:05 +0000, LR <lrme@privacy.net> wrote:
>I will apologise for not reading all your post before replying.
Congratulations. You're developing my bad habits. Hopefully, it's
not contageous.
>With regards to "Vistumbler" as my vista machine is running AVG8 there
>is a problem whereby AVG flags newer versions of the "vistumbler.exe"
>file as a "worm/AUTOIT.PKW" and neither AVG nor the authors of
>vistumbler have resolved this issue.
Yeah, I saw that. I don't recall the version. I have to keep fishing
it out of the virus vault. I'm kinda used to it. Run the scan and
undo the damage. My other scanners (SuperAntiSpyware and
Malwarebytes) don't have the problem. Mostly, I do my sniffing from
the command line.
netsh wlan show networks mode=bssid
> I do have a version of Vistumbler installed which has no problems with
>AVG and it is the 7.43 beta version.
That's old. Current version is 9.0. My Vista laptop is out on loan
to convince a customer that they don't want Vista. So far, it's
working. I just went through the version history:
<http://vistumbler.sourceforge.net/verhist.htm>
No mention of virus problems. I use AVG 8.0 but I don't recall seeing
this problem. Thanks for the warning.
> That's old. Current version is 9.0. My Vista laptop is out on loan
> to convince a customer that they don't want Vista. So far, it's
> working. I just went through the version history:
> <http://vistumbler.sourceforge.net/verhist.htm>
> No mention of virus problems. I use AVG 8.0 but I don't recall seeing
> this problem. Thanks for the warning.
>
>
>
I decided to try all the versions again this morning and had no problems
up to ver 8.1.
However installing ver 9 causes avg8 to detect the worm. Today is the
first time I have noticed on the install that it says that an update has
been detected and would you like to install it, I have evidently always
considered this to be a good idea and installed it. If you don't agree
to the update then AVG8 does not detect a worm, however if you then use
the check for updates and then download the update a worm will be
detected. When I run ver 9 it works OK apart from the fact I get a
connection nag screen even though I am connected to network.
There is a ver 9-1_b3 which also has the worm problem.
<http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/v/vi/vistumbler/>
>> I have decided to give up on Netstumbler on this XP SP2 machine and
>> stick with Inssider and Wifihopper.
Having a browse on dslreports today they mentioned that there was a new
version of Inssider that now has a channel display. It certainly gives
you a better idea of whether nearby AP's may cause interference.
Although it only shows 11 channels on the scale it does cover the full
range.
On 27/02/2009 09:00, LR wrote:
> On 26/02/2009 21:32, Jeff Liebermann wrote:
>
>> That's old. Current version is 9.0. My Vista laptop is out on loan
>> to convince a customer that they don't want Vista. So far, it's
>> working. I just went through the version history:
>> <http://vistumbler.sourceforge.net/verhist.htm>
>> No mention of virus problems. I use AVG 8.0 but I don't recall seeing
>> this problem. Thanks for the warning.
>>
>>
>>
> I decided to try all the versions again this morning and had no problems
> up to ver 8.1.
> However installing ver 9 causes avg8 to detect the worm. Today is the
> first time I have noticed on the install that it says that an update has
> been detected and would you like to install it, I have evidently always
> considered this to be a good idea and installed it. If you don't agree
> to the update then AVG8 does not detect a worm, however if you then use
> the check for updates and then download the update a worm will be
> detected. When I run ver 9 it works OK apart from the fact I get a
> connection nag screen even though I am connected to network.
> There is a ver 9-1_b3 which also has the worm problem.
> <http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/v/vi/vistumbler/>
>
>
>
Further to this, AVG8.5 is now out so I decided to try this and yet
again if the update for ver9 of Vistumbler is installed then AVG8.5
detects vistumbler.exe as a worm and also detects a worm in the
temp/internet files. This time I also installed Avira and Clamwin and
scanned the Vistumbler files, neither of these show a worm however both
of these have access to vistumbler.exe denied so there is definitely
something odd about the update files.
WEP/WPA - how to tell which one 
Linear Mode
