Finding wireless access points.
jim
I don't mean simply being able to connect to them, but actually finding the
building and room that the signal is coming from.
How do you track down the physical location of the wireless access point
device that you can detect using netstumbler or other such software?
Thanks!
jim
MyVeryOwnSelf
One list is at http://www.netstumbler.com/hotspots/
ps56k
"jim" <j...@home.net> wrote in message
news:4ml%j.72794$3v1....@bignews3.bellsouth.net...
you mean just like on TV - CSI, NCIS, or Numbers ??
smlunatick
To add to this:
Add one GPS compatible with Netstumbler and start "scanning."
Jack (MVP-Networking).
May be this can Help., http://www.passmark.com/products/wirelessmonitor.htm
Jack (MVP-Networking).
"jim" <j...@home.net> wrote in message
news:4ml%j.72794$3v1....@bignews3.bellsouth.net...
Jeff Liebermann
>Can anyone direct me to some good info on finding wireless access points?
Search Google for "wi-fi direction finding".
I've also posted some comments on the subject:
<http://groups.google.com/groups?as_q=direction+finding+map+lines&num=50&scoring=r&hl=en&as_epq=&as_oq=&as_eq=&as_ugroup=alt.internet.wireless&as_usubject=&as_uauthors=Jeff+Liebermann&lr=lang_en&as_drrb=q&as_qdr=&as_mind=1&as_minm=1&as_miny=1981&as_maxd=28&as_maxm=5&as_maxy=2008&safe=off>
This one covers the basics:
<http://groups.google.com/group/alt.internet.wireless/msg/8998c66ef1df00f7>
Note that it does take some practice. I suggest you try finding a
known access point first. Also, be prepared to answer dumb questions
from the police and officials. To the clueless, you will probably
look like a terrorist.
>I don't mean simply being able to connect to them, but actually finding the
>building and room that the signal is coming from.
Yeah. That's called "radio direction finding".
>How do you track down the physical location of the wireless access point
>device that you can detect using netstumbler or other such software?
See above URL.
--
Jeff Liebermann je...@cruzio.com
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558
jim
"Jeff Liebermann" <je...@cruzio.com> wrote in message
news:fn9s349r3e6qdmha9...@4ax.com...
> On Wed, 28 May 2008 18:52:46 -0400, "jim" <j...@home.net> wrote:
>
>>Can anyone direct me to some good info on finding wireless access points?
>
> Search Google for "wi-fi direction finding".
Thanks for that. Searching for the proper terms does seem to enhance the
result set returned by Google.
>
> I've also posted some comments on the subject:
> <http://groups.google.com/groups?as_q=direction+finding+map+lines&num=50&scoring=r&hl=en&as_epq=&as_oq=&as_eq=&as_ugroup=alt.internet.wireless&as_usubject=&as_uauthors=Jeff+Liebermann&lr=lang_en&as_drrb=q&as_qdr=&as_mind=1&as_minm=1&as_miny=1981&as_maxd=28&as_maxm=5&as_maxy=2008&safe=off>
>
Great suggestions!
> This one covers the basics:
> <http://groups.google.com/group/alt.internet.wireless/msg/8998c66ef1df00f7>
> Note that it does take some practice. I suggest you try finding a
> known access point first. Also, be prepared to answer dumb questions
> from the police and officials. To the clueless, you will probably
> look like a terrorist.
LOL! I actually got pulled over about 1 this morning while war driving and
testing out my cantenna setup. It was a riot! They wanted to know what
"that gun looking thing" was...(it was my new cantenna with a pistol grip).
They did ask me to please do it during daylight hours (they said they have
been having problems with some burglaries and such). But, my slowly
cruising the 'hoods and jamming up traffic during the day will certainly
piss them off too. I'll just remind them that it was their idea - not mine.
War driving is addictive. I did it for 3-4hours and found approx 600
wireless access points. About 30% have no protection whatsoever. About 50%
have WEP (really no security wahtsoever). And the other 20% have WPA+.
>
>>I don't mean simply being able to connect to them, but actually finding
>>the
>>building and room that the signal is coming from.
>
> Yeah. That's called "radio direction finding".
Sweet.
>
>>How do you track down the physical location of the wireless access point
>>device that you can detect using netstumbler or other such software?
I'm using WirelessMon right now. It is pretty good. I use the RSSI values
to home in on a signal. Then, I realize I am chasing a reflection and go on
the opposit direction (lol).
I am considering a 3 cantenna setup where the left and right cantennas are
offset by -45 degrees and + 45 degrees. I'll need software that can watch 3
antennaes simultaneously - which means I may have to write it (or pay
someone to write it) - but it may be worth the trouble.
Thanks so much for your help!
P.S. I added a green laser pointer to my setup to help locate wireless
access points from outside multi-floored buildings. Don't know if it'll
help much, but it looks cool.
jim
jim
Vista.
jim
"Jack (MVP-Networking)." <ja...@discussiongroup.com> wrote in message
news:eqJ5GiTw...@TK2MSFTNGP02.phx.gbl...
jim
"ps56k" <pschuman_...@interserv.com> wrote in message
news:j5n%j.4975$mh5....@nlpi067.nbdc.sbc.com...
I have no idea what you are talking about. I have never seen any of those
shows - too busy working.
jim
LR
> War driving is addictive. I did it for 3-4hours and found approx 600
> wireless access points. About 30% have no protection whatsoever. About 50%
> have WEP (really no security wahtsoever). And the other 20% have WPA+.
>
If it has become addictive you may be interested in Wigle.
http://www.wigle.net/
jim
"LR" <lr...@privacy.net> wrote in message
news:kt2dnSI-i6Co-6PV...@bt.com...
Here are some pics of my beginner setup.....
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010005.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010006.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010007.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010008.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010009.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010010.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010011.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010012.jpg
http://i303.photobucket.com/albums/nn121/wardriverjim/S2010014.jpg
jim
jim
http://s303.photobucket.com/albums/nn121/wardriverjim/
jim
"jim" <j...@home.net> wrote in message
news:llu%j.19190$hv2....@bignews5.bellsouth.net...
ps56k
(not sure Hawkings can sell WiFi at this point in time - legal issues)
I specifically had an old Orinico PCMCIA card
because it had the external antenna connector,
but never used it...
Just driving around our area with the laptop open on the front seat,
and running NetStumbler,
I can usually pick up several dozen access points.
jim wrote:
> Oops.....this probably would have been easier....
>
> http://s303.photobucket.com/albums/nn121/wardriverjim/
>
> jim
>
>>>
ps56k
> I don't mean simply being able to connect to them, but actually
> finding the building and room that the signal is coming from.
>
> How do you track down the physical location of the wireless access
> point device that you can detect using netstumbler or other such
> software?
what are you trying to do ?
It's different if you are wardriving around,
and can have a laptop + the cantenna all in the car...
If you are trying to locate rogue AP's around your company/school,
then how are you physically gonna carry the required "stuff" around the
floors & halls ?
Since you mention "building & room", it's hard to guess exactly your
"situation" ?
jim
The original intent was to find rougue waps on a couple of company campuses.
the wardriving was just something fun to do and to get a little experience
in using the cantenna.
jim
Jeff Liebermann
>LOL! I actually got pulled over about 1 this morning while war driving and
>testing out my cantenna setup. It was a riot! They wanted to know what
>"that gun looking thing" was...(it was my new cantenna with a pistol grip).
My height of stupidity was walking around a shopping center parking
lot, in the middle of the afternoon, with a 20ft foot fiberglass pole,
19dBi dish antenna, into a laptop and portable spectrum analyzer. It
took the police about 90 minutes to arrive. They would have ignored
me, but after about a dozen phone calls from panicy shoppers, they
were curious. I was ready. I had copies of my FCC GROL license,
ID's, business cards, printed data on the hardware, etc. The business
cards were a mistake, as I later received the traditional "can you fix
my computer" type calls.
This was not the first time I attracted attention. When I got my
first laptop (Zenith Z180) back in the late 1980's, I decided to try
logging in via accoustic modem in a pay telephone booth. It took me
about 15 minutes to convince the sheriff that I wasn't using the
computer to steal money out of the pay telephone.
>They did ask me to please do it during daylight hours (they said they have
>been having problems with some burglaries and such). But, my slowly
>cruising the 'hoods and jamming up traffic during the day will certainly
>piss them off too. I'll just remind them that it was their idea - not mine.
Who is "they"?
Night time is better. The moving vehicles create reflections, which
are a major problem for direction finding. When the parking lots and
streets empty, it's much eaasier. There's also less RFI
(interference) from other Wi-Fi systems.
>War driving is addictive. I did it for 3-4hours and found approx 600
>wireless access points. About 30% have no protection whatsoever. About 50%
>have WEP (really no security wahtsoever). And the other 20% have WPA+.
Around here, about 20% have the default SSID and no encryption, which
indicates that they've never been configured. Shooting fish in a
barrel has never been very interesting.
>I'm using WirelessMon right now. It is pretty good. I use the RSSI values
>to home in on a signal. Then, I realize I am chasing a reflection and go on
>the opposit direction (lol).
Reflections are always a problem. That's why I indicated that you
should use map and draw as many lines of position from as many
different locations as possible. Many of these lines will be obvious
reflections, but the bulk of them will cross at one point. There is
also software to help do this, but I can't seem to find any at the
moment. There's also some equipment I've designed that will help, but
I'll need permission to discuss it. This might help:
<http://www.qsl.net/n9zia/doppler_notes1.txt>
<http://www.qsl.net/n9zia/doppler_notes2.txt>
<http://www.homingin.com>
>I am considering a 3 cantenna setup where the left and right cantennas are
>offset by -45 degrees and + 45 degrees. I'll need software that can watch 3
>antennaes simultaneously - which means I may have to write it (or pay
>someone to write it) - but it may be worth the trouble.
Bad, very bad idea. The cantenna does not have a narrow enough
beamwidth. It's also not really symmetrical. See:
<http://802.11junk.com/jeffl/antennas/coffee2400/index.html>
That's a beamwidth of about 70 degrees. Not very good for direction
finding.
What you want is a commerical dish antenna. The 24dBi variety have a
beamwidth of about 7 degrees. Nice and sharp, which is great for
pointing, but also good for eliminating inteference and reflections
coming from any direction except straight ahead. The problem is that
the 24dBi dish is big and heavy. However, there are 15 and 19dBi
versions which are good enough. You can also use a panel antenna, but
watch out for side lobes, which will cause some doubt as to the exact
direction. Forget about yagi's as they have far too many side lobes.
One big problem is too much gain when you're close. A 24dBi dish is
great for long range and sharp aiming. It's a disaster when you're
really close and find that the receiver is overloaded. You'll need an
RF attenuator (usually with N connectors) to reduce the signal to
reasonable levels.
Another problem when you get close is that you can unplug the antenna
and still hear the signal. Most wireless laptops and access points
are not very well shielded. You may find yourself working with the
laptop inside a shielded metal box. I use a carboard box, lines with
aluminum foil, and a brass wire screen on one side to view the LCD.
>P.S. I added a green laser pointer to my setup to help locate wireless
>access points from outside multi-floored buildings. Don't know if it'll
>help much, but it looks cool.
Also a bad idea. Point that in someone's face and you're going to
draw fire. Use a telescope or sight tube (piece of plastic pipe) for
sighting. If on top of a pole, use a cheap USB camera.
I can see you're going to need some practice with this. Try it in
your own neighborhood first. I think you'll find it somewhat
challenging until you shake out the bugs in your equipment and
technique.
Jeff Liebermann
>That's just what I am using. Netstumbler did not work with my Sony laptop +
>Vista.
See ViStumbler:
<http://www.techidiots.net/project-pages/vistumbler/view>
for Vista.
You can also use:
wlan show networks mode=bssid
from the "cmd" prompt.
jim
> On Thu, 29 May 2008 04:05:04 -0400, "jim" <j...@home.net> wrote:
>
>>LOL! I actually got pulled over about 1 this morning while war driving
>>and
>>testing out my cantenna setup. It was a riot! They wanted to know what
>>"that gun looking thing" was...(it was my new cantenna with a pistol
>>grip).
>
> My height of stupidity was walking around a shopping center parking
> lot, in the middle of the afternoon, with a 20ft foot fiberglass pole,
> 19dBi dish antenna, into a laptop and portable spectrum analyzer. It
> took the police about 90 minutes to arrive. They would have ignored
> me, but after about a dozen phone calls from panicy shoppers, they
> were curious. I was ready. I had copies of my FCC GROL license,
> ID's, business cards, printed data on the hardware, etc.
Awesome!
> The business
> cards were a mistake, as I later received the traditional "can you fix
> my computer" type calls.
I feel ya. I do small business networks and constantly get calls to go to
people's homes to fix their kid's PC or remove spyware and crap. I refuse
all home calls except for the employees of the companies that I suuport.
(I'd refuse those too, but I want to help keep thier home systems clean as
to not infectthe business when they take stuff back and forth between home
and work.)
>
> This was not the first time I attracted attention. When I got my
> first laptop (Zenith Z180) back in the late 1980's, I decided to try
> logging in via accoustic modem in a pay telephone booth. It took me
> about 15 minutes to convince the sheriff that I wasn't using the
> computer to steal money out of the pay telephone.
I used to write the software that programmed payphones. Had to leave there
when the owner of the company started having death threats FAXED to the
office because of his business practices.
>
>>They did ask me to please do it during daylight hours (they said they have
>>been having problems with some burglaries and such). But, my slowly
>>cruising the 'hoods and jamming up traffic during the day will certainly
>>piss them off too. I'll just remind them that it was their idea - not
>>mine.
>
> Who is "they"?
The nice policemen that pulled me over.
> Night time is better. The moving vehicles create reflections, which
> are a major problem for direction finding. When the parking lots and
> streets empty, it's much eaasier. There's also less RFI
> (interference) from other Wi-Fi systems.
Not to mention less traffic (since I do it driving).
>
>>War driving is addictive. I did it for 3-4hours and found approx 600
>>wireless access points. About 30% have no protection whatsoever. About
>>50%
>>have WEP (really no security wahtsoever). And the other 20% have WPA+.
>
> Around here, about 20% have the default SSID and no encryption, which
> indicates that they've never been configured. Shooting fish in a
> barrel has never been very interesting.
No, it really is no fun at all. But, I am gathering data for a newspaper
article also, and the number of insecure systems is simply shocking.
>
>>I'm using WirelessMon right now. It is pretty good. I use the RSSI
>>values
>>to home in on a signal. Then, I realize I am chasing a reflection and go
>>on
>>the opposit direction (lol).
>
> Reflections are always a problem. That's why I indicated that you
> should use map and draw as many lines of position from as many
> different locations as possible. Many of these lines will be obvious
> reflections, but the bulk of them will cross at one point. There is
> also software to help do this, but I can't seem to find any at the
> moment. There's also some equipment I've designed that will help, but
> I'll need permission to discuss it. This might help:
> <http://www.qsl.net/n9zia/doppler_notes1.txt>
> <http://www.qsl.net/n9zia/doppler_notes2.txt>
> <http://www.homingin.com>
I've actually had pretty good luck with the cantenna and close monitoring.
Not so much luck in the daytime as at night.
>
>>I am considering a 3 cantenna setup where the left and right cantennas are
>>offset by -45 degrees and + 45 degrees. I'll need software that can watch
>>3
>>antennaes simultaneously - which means I may have to write it (or pay
>>someone to write it) - but it may be worth the trouble.
>
> Bad, very bad idea. The cantenna does not have a narrow enough
> beamwidth. It's also not really symmetrical. See:
> <http://802.11junk.com/jeffl/antennas/coffee2400/index.html>
> That's a beamwidth of about 70 degrees. Not very good for direction
> finding.
>
> What you want is a commerical dish antenna. The 24dBi variety have a
> beamwidth of about 7 degrees. Nice and sharp, which is great for
> pointing, but also good for eliminating inteference and reflections
> coming from any direction except straight ahead. The problem is that
> the 24dBi dish is big and heavy. However, there are 15 and 19dBi
> versions which are good enough. You can also use a panel antenna, but
> watch out for side lobes, which will cause some doubt as to the exact
> direction. Forget about yagi's as they have far too many side lobes.
>
> One big problem is too much gain when you're close. A 24dBi dish is
> great for long range and sharp aiming. It's a disaster when you're
> really close and find that the receiver is overloaded. You'll need an
> RF attenuator (usually with N connectors) to reduce the signal to
> reasonable levels.
what about covering the end of the cantenna with foil and cutting a thin
slit in it to allow signal in?
>
> Another problem when you get close is that you can unplug the antenna
> and still hear the signal. Most wireless laptops and access points
> are not very well shielded. You may find yourself working with the
> laptop inside a shielded metal box. I use a carboard box, lines with
> aluminum foil, and a brass wire screen on one side to view the LCD.
Good idea.
>
>>P.S. I added a green laser pointer to my setup to help locate wireless
>>access points from outside multi-floored buildings. Don't know if it'll
>>help much, but it looks cool.
>
> Also a bad idea. Point that in someone's face and you're going to
> draw fire. Use a telescope or sight tube (piece of plastic pipe) for
> sighting. If on top of a pole, use a cheap USB camera.
My targets were business buildings at night. Reduces the chance of drawing
fire or accidentally blinding someone. After i tried it a couple of times,
the bright green beem and spot was sure to draw interested parties (police),
so I packed in the laser and just stuck with the cantenna.
>
> I can see you're going to need some practice with this. Try it in
> your own neighborhood first. I think you'll find it somewhat
> challenging until you shake out the bugs in your equipment and
> technique.
Yep. I can see that there is a bit to learn about not only the theory, but
also about my own equipment's idiocyncracies. But, it's fun - so practice
is no problem.
Thanks again for all of your help.
jim
msg
<snip>
>
> What you want is a commerical dish antenna. The 24dBi variety have a
> beamwidth of about 7 degrees. Nice and sharp, which is great for
> pointing, but also good for eliminating inteference and reflections
> coming from any direction except straight ahead.
Jeff,
Now that you have jumped into this RDF thread with both feet, could
you consider obtaining the airsleuth package so we might learn
why the s/w aborts with:
"Check for security id failed -- would you like to run the application
in simulation mode?"
This is on the Proxim hardware the package is supposed to support. Some
many months ago you were 'too busy' for 'more projects', but IMHO this
one has merit.
Regards,
Michael
ps56k
> My height of stupidity was walking around a shopping center parking
> lot, in the middle of the afternoon, with a 20ft foot fiberglass pole,
> 19dBi dish antenna, into a laptop and portable spectrum analyzer. It
> took the police about 90 minutes to arrive. They would have ignored
> me, but after about a dozen phone calls from panicy shoppers, they
> were curious. I was ready. I had copies of my FCC GROL license,
> ID's, business cards, printed data on the hardware, etc. The business
> cards were a mistake, as I later received the traditional "can you fix
> my computer" type calls.
>
how about 2 meter foxhunts ?
driving around with a 2m directional antenna
out the window or rotated on the roof :)
Jeff Liebermann
>Now that you have jumped into this RDF thread with both feet,
Yeah, I know. Ever since I had a heart bypass operation, I've never
done anything half-heartedly.
>could
>you consider obtaining the airsleuth package so we might learn
>why the s/w aborts with:
>
> "Check for security id failed -- would you like to run the application
> in simulation mode?"
That sounds like a failure of the license key. Without the license,
it goes into demo (simulation) mode. I think that's the way the demo
version runs as the license key is probably tied to the MAC address of
the PCMCIA card.
<http://www.nutsaboutnets.com/performance-wifi/main/downloads-wifi-spectrum-analyzer.htm>
Which version?
>This is on the Proxim hardware the package is supposed to support. Some
>many months ago you were 'too busy' for 'more projects', but IMHO this
>one has merit.
Well, I have 4 of the Proxim RangeLAN2 7400 cards.
http://www.kmj.com/proxim/7400.html
They all have lousy sensitivity. I refuse to install the Proxim
driver that comes with the card on any of my machine because of the
extreme difficulties I've had trying to uninstal and/or rip out the
driver. Also, most of my laptops run XP. The driver does't work
under XP.
Sorry, but I have a few other things I would prefer doing.
--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558 je...@comix.santa-cruz.ca.us
# http://802.11junk.com je...@cruzio.com
# http://www.LearnByDestroying.com AE6KS
msg
> On Thu, 29 May 2008 14:59:29 -0500, msg <msg@_cybertheque.org_> wrote:
<snip>
>
>>could
>>you consider obtaining the airsleuth package so we might learn
>>why the s/w aborts with:
>>
>> "Check for security id failed -- would you like to run the application
>> in simulation mode?"
>
>
> That sounds like a failure of the license key. Without the license,
> it goes into demo (simulation) mode. I think that's the way the demo
> version runs as the license key is probably tied to the MAC address of
> the PCMCIA card.
Hmmm, the vendor states that a user can use the software from a
distribution cd or as downloaded from their website; there is
no mention of any keyfile or software keys.
>
> <http://www.nutsaboutnets.com/performance-wifi/main/downloads-wifi-spectrum-analyzer.htm>
> Which version?
The problem is seen on both versions.
>
>
>>This is on the Proxim hardware the package is supposed to support. Some
>>many months ago you were 'too busy' for 'more projects', but IMHO this
>>one has merit.
>
>
> Well, I have 4 of the Proxim RangeLAN2 7400 cards.
Not RangeLAN2 but HomeRF2 cards (USB and PCMCIA)
See earlier threads with keyword 'airsleuth' or 'HomeRF' in this N.G.
This hardware must have been bought in volume by the package
vendor, before it all ran out; but the question remains as to how
they could alter anything in the hardware for a key.
A question for the general readership: has anyone purchased any
airsleuth products? Does the software shipped with the product
differ from that on the website, including having more files
or different files?
Michael
Jeff Liebermann
<pschuman_...@interserv.com> wrote:
>how about 2 meter foxhunts ?
>driving around with a 2m directional antenna
>out the window or rotated on the roof :)
I used to do that at least once a month. Learned a few things, which
unfortunately included that I can get lost even with all the
technology, maps, and directions. Ending up 20 miles away from the
hidden transmitter taught me that there was more to foxhunts than
pointing the yagi and driving like a maniac.
Some comments on rotating antenna direction finders versus doppler
type direction finders can be found in my previous rants at:
<http://www.qsl.net/n9zia/doppler_notes1.txt>
<http://www.qsl.net/n9zia/doppler_notes2.txt>
The Santa Barbara transmitter hunters pioneered using butchered radar
heads for VHF direction finding. They would replace the dish on the
radar with a yagi, and use the synchro driven PPI scope to display the
signal strength versus the bearing. There were a series of articles
in 73 magazine describing the hardware and its operation. This would
probably be a great way to do direction finding in a vehicle. These
days, you don't need a mechanical nightmare to spin the antenna. Lots
of tricks available that will display the pattern on a laptop. With
some programming, it can be integrated with mapping software and GPS.
Some of these features are presently in some version of APRS software,
but nothing that's really suitable for Wi-Fi direction finding.
As I previously hinted, driving around is only part of the puzzle.
When you get close, the big antenna is nearly useless. You have to
get out of the vehicle, and do some "sniffing" with a hand held
antenna and radio. Incidentally, that's lots of fun when you come
face to face with a tall glass wall office building, where the
interference could be coming from any of the offices on almost any
floor. Got a helicopter?
Hint: There are antennas with very narrow beamwidths in only one
axis:
<http://pe2er.nl/wifisector/>
<http://www.brest-wireless.net/gallery/AntenneAmos>
Also, among the not so great ideas, is the Bluetooth Rifle:
<http://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html>
The idea is to NOT be too obvious.