Printable View
Hi, I have a wireless 1 computer "network" where I have wall--DesktopPC--WirelessRouter and then Laptop that I connect to wireless router. (My DesktopPC has 2 network cards)
Is there an easy way to see if anyone else is connecting to my wireless network (aside from loging into the router and looking at mac addresses present)?
Thanks,
RMSe17
sure. download and start up ethereal. Watch the source IP addresses. the only ones you should see are your laptop IP, the desktop IP, the router IP, and of course the broadcast IP. anymore and you got your self a possible intruder. Somone else just posted about wireless a bit ago, take a look at my response there for some tips to protect your network
To make things easier, I found it very usefull:
let me give you a run down of basic precausions you will want to take.Quote:
Somone else just posted about wireless a bit ago, take a look at my response there for some tips to protect your network
Step 1) Change the default username and password on the router. There is no point in any other security if the thing that controls the security can be accessed by anyone.
Step 2) turn on WEP or WPA if your router supports it and use a strong key (think of the keys as a assword to your network and create your key with that mindset)
Step 3) use static IP addresses if possible, and Limit the IPs that can be released. On my network I have 3 computer so only 3 IP addresses can be assigned.
Step 4) If possible turn on MAC filtering.
Step 5) Stop broadcasting SSID. This is debateable and many will argue it auses more problems then its worth, but in my opinion it is a good step in hiding your self. its a method of security through obscurity which I persoannly am a big fan of as long as it is used with other layersof security.
Step 6) keep your router firmware up to date, and keep your computers patched.
follow the above and you should be pretty good to go.
for a little added security if you are really worried, do things like use multiple WEP keys if your router supports it, and alternate the WEP keys. Let the guy that is cracking deal with cracking the wep every few days.. Also run a constant capture with ethereal and if you notice alot of traffc and know its not you, than you either have a fun virus (which is damn good to know about anyway) or somone if using your network. Check the router on occassion to see if anyone has gotten an IP assigned to them that shouldnt have. Turn ont he logs for the router (most cheap ones have this feature off by default). And practice good monitoring of traffic and of logs. These will really lock you down tight. good luck.
All of the above look good except 5. Here are my reason:Quote:
Originally posted here by CyberGlyph
Step 5) Stop broadcasting SSID. This is debateable and many will argue it auses more problems then its worth, but in my opinion it is a good step in hiding your self. its a method of security through obscurity which I persoannly am a big fan of as long as it is used with other layersof security.
[/B]
1. Some clients do seem to have issue with connecting to the WEP if you turn off SSID broadcasting.
2. SSID broadcasting lets others near by know which channel you are on so they can set up their WAP to use a different one and you won’t interfere with each other.
3. Kismet, or and war driving tool that can use RF Mon mode, can see the SSID anyway if there is much traffic at all. Cloaking the SSID may hide it from NetStumbler, but not Kismet.
The reason i say to not broadcast SSID is not to stop people who are actually looking to break into the network, but to stop people who just turn on their laptop from seeingit. I understand that it can cause problems, but I never had difficulty with it. thats why I said that its good to use with other layers of security as well. Alone it really isnt all that great, but it is one more layer to help.
oh and cypher, thanks for copying my reply from the other thread to here.
AirSnare is a nice free program you can run to watch who is connected to your wireles router.
You can confgure it to send a mesage to anyone that connects also.
http://www.snapfiles.com/php/downloa...10066195&loc=1
Now that I have enough programs to detect 'hotspots' and secure my network, but what about the other programs; what programs are people using to get on wireless networks like mine? Its always nice to know how to be on both sides of the fence if you know what I mean. I have done some searching around to see what I could find about wireless hacking, but my efforts have came up a little short. Any info here to point me to a good faq type of site would be great.
google wireless hacking,
you will find a ton of stuff.
A majority of the stuff out there is more sniffing out access points, like as as mentioned with kismet, and netstumbler. There are also a lot of wep breaking utiltiies such as airsnort, and even wpa comprimising utilities.
Check out a distro like Auditor, or Knoppix STD and put it on a junk machine and play around with your network.
You could look up AirSnort on Google...
If you just want to see if anyone else is on the network I suggest using any generic sniffer and watching for MAC addresses you don't recognize. You'll want to look for IP's you don't know as well since it's possible for two computers on a wireless net to have identical MAC's.
If you want to secure your wireless net you'll have to go through more trouble than most people would like you to believe. Even using WEP won't help you much with some of the newer tools that've come out, such as weplab and aircrack.
MAC address filtering sounds effective but it's defeatable just by listening to the network long enought to find a valid MAC and then changing your card's MAC to match. As long as the attacker has a different IP than the comp whose MAC they're using it'll work just fine. If the IP's are the same then neither computer will be able to talk to the network.
My suggestions for securing your network are as follows:
1) Set static IP's on all the computer that are supposed to be using it, then turn off the DHCP server on your router so it won't assign anyone addresses.
2) Turn on MAC filtering, and set up your router to only allow the IP's your computers are using to connect to the internet. Some AP's will let you filter based on IP but not all.
3) Turn on WEP so your data can't be sniffed. Use a good key based on a random word, and use at least a 128bit key.
4) Don't bother with cloaking since it won't stop anyone who knows what they're doing.
The above will only help you much if you're able to filter based on IP's as well as MAC's. If you follow those steps then even if someone does get on your network they won't be able to make any connections. Also, turning off DHCP and setting up your clients manually prevents some sniffing attacks based on DHCP spoofing.
Hi, sorry I didn't reply for long time, I read the responses as they came, and tried out a few things. Maybe I am just retarded, but for some reason I couldnt get Ethereal to capture any packets through my wireless card (Dell 8600 with Intel 2200 using Intel drivers)
As to my router, it is set up with MAC exclusion/inclusion list, where just 2 of my computers are allowed. I dont have WEP, since I couldn't get Linux to automatically connect to my connection and to university connection if mine had WEP. It either would connect to mine with WEP, or to University one... when I have no WEP, it connects to both without setup change...
By the way, it is possible to read everything I am sending via wireless, even if they cant connect to my router, right?
in ethereal make sure you have your wirless card selected as the adapter to use. That is a simple thing to over look and I have made that mistake when I first started toying with it.
Yes it is possible to grab data without connecting to the router (that is how you crack weps and what not)
Quote:
Originally posted here by XTC46
in ethereal make sure you have your wirless card selected as the adapter to use. That is a simple thing to over look and I have made that mistake when I first started toying with it.
Yes it is possible to grab data without connecting to the router (that is how you crack weps and what not)
But he would have to have tools and an OS that allow RF Mon mode. Linux and Ethereal may be able to do it, but I don't think Windows and Ethereal will. You could use Kismet from a boot CD, take the pcap dumpfile and open that later in Ethereal on any platform.
My guess as to why Ethereal doesn't capture packets is that you're not telling it to use the right interface. When I capture packets I just use Kismet to do it and then pipe the dumps through Ethereal.
As far as MAC filtering, don't bother. Due to the way 802.11b works it's possible for two computers on the same network to have identical MAC addresses as long as they don't have the same IP. All someone has to do is listen to your network long enough to find a valid MAC address and then change their card to use it.
Your wireless problem could be fixed by making a bash script you could run that would tell the card which network you're using. If it's having a problem deciding which to use, keep in mind that the iwconfig command allows you to specify which ESSID to become part of, and the BSSID of the correct AP.
In order to capture packets on a wireless network you need to be in promiscuous mode. Not all wireless cards can do this. As far as I know, only the oninoco and the prism chipsets, and some cisco cards can do this. Most cards discard packets that aren't destined for the machine at a low level in the OSI model and don't even make it to the software.
I know for sure that Cisco Aironet cards (350 series) can do this (on Linux anyway), as well as the popular Atheros chipsets found in some laptops. Prism one's can, and orinoco can with a patched driver.
Rfmon mode works really well on Aironet cards. The only thing you might run into is that the channel hopping code built into Kismet can't make an Airnet card hop channels. It's simple enough to make a script that hops for you though.
this is a stupid piece of advice. Saying not to use a form of security becasue it can be defeated is dumb. I could just as easily say dont use wep becasue it can be cracked, dont use passwords on your box becasue i can bruteforce/dictionary attack and crack them, dont lock the front door to your house becasue I can kick the door down etc. NO METHOD OF SECURITY IS FLAWLESS, the point is to make it not worth breaking into.Quote:
As far as MAC filtering, don't bother. Due to the way 802.11b works it's possible for two computers on the same network to have identical MAC addresses as long as they don't have the same IP. All someone has to do is listen to your network long enough to find a valid MAC address and then change their card to use it.
I meant he shouldn't rely on it.....
no one should rely on a single piece of security.
To quote zencoder who was making a cheap attempt to reffrence shrek 2. Good Security is like an onion....it stinks and makes people cry....wait no that wasnt it. Oh It has layers. NEVER use just 1 layer of security.
I use these two tools to detect unfriendly wireless users,
Retina Wireless network security scanner - which also comes with WEP key brute force (testing with your own key of course ;-) )
Airsnare - can be used for the ethernet as well, sweet.....