Slashdot Mirror
Wi-Fi Network Monitoring Tools?
Brian the Wise asks: "For all of you with large and/or complex wireless networks out there, what tools (commercial or otherwise) do you use to keep an eye on the health and state of your network? I'm not only interested in the security/IDS side of things, but also bad packets, reflections, clients flip-flopping between APs, etc. I've looked at all the usual open source projects, and so far Kismet comes the closest to my needs, but the wireless drivers on Linux do too much sanitizing of packets so I never see the bad ones. I know the FreeBSD drivers show more, but some of the advanced stuff (ie extra info from the Cisco Aironet drivers) is not supported by tcpdump or ethereal. Is there anything I can do besides getting up close and personal with the Linux network stack and drivers?"
Is there anything I can do besides getting up close and personal with the Linux network stack and drivers?
Maybe.
With my cheap linksys Prism2 card and the Wlan-ng (well that was a while ago, but I supposed the most recent versions are at least as good) I used to see a lot of bad packets in Kismet... What sucks is that there's no way any driver will report signal strength accurately...to do that maybe a radio scanner would be the best tool..
...an SNMP-enabled wireless card, followed by every other brand within 6 months.
What is the best, high powered 100mw-200mw, high sensitivity receiver pcmcia/pccard adapter you can buy that works great with Linux? External antenna ports are a plus.
I have looked at the Senao 200mw cards and am thinking about buying one, good or bad choice?
I say get one of these: http://www.proxim.com/products/wifi/client/abgcard /index.html
This is a Scanner tool, I find it to be usually faster and better at finding access points / cards.
http://www.wellenreiter.net/
[blue] - The Ministry of Information approved this message...
What should I do to allow for secure wireless internet access?
[blue] - The Ministry of Information approved this message...
I keep an eye on my wireless subnet with a separate box running kismet... tells me everything I need to know.
Heh... it also told me immediately the first time my neighbor fired up his brand-spanking-new access point. I went over to his house (where he was washing his car) and asked him if he'd gotten a new AP for christmas? (nod) a Linksys? (another nod) running on channel 6? (confused look and another nod)... I briefly explained wireless network surveillance/network sniffers, and gave him some basic tips on WEP, disabling SSID broadcasting, and MAC address filtering. He thinks I'm some kind of hacker now... got a feeling I'll be getting some "tech support" calls from their place...
Works for me, and it's free... works well with the prism2-based cards. I bought a bunch of these: and they work great with the wlan drivers.
Your mileage may vary, of course.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
"For all of you with large and/or complex wireless networks out there, what tools (commercial or otherwise) do you use to keep an eye on the health and state of your network?"
;-)
Its called a user
Asmo
If you've got the cash to spare, AirDefense is a great product. It gives you all the info that you're looking for, including some of the layer 2 error reporting that you need, with easy to use remote sensors.
It ain't cheap, however.
It also does so much reporting that you need to go in an turn some of the alarms off because it's usually too sensitive.
If you're trying to do it on the cheap, I suggest Kismet with WRT54G remote sensors. It's not the best solution in the world, but you can build a heck of a monitoring system for $1000.
Someones submitted an SBIR proposal claiming to be able to do this and has also submitted an Askslashdot question in order to wring the answer from us!
Watch out!
On January 14, the Christmas Island Internet Administration abruptly disabled everyone's favorite domain, goatse.cx. All joking aside, this action brings up serious questions regarding registrars exercising control over the content of websites they don't host. Goatse's geek appeal as a cult phenomenon is arguably stronger than AYBABTU, and has been an omnipresent icon here at Slashdot for years. There's a petition, as well as a thread at the .cx registrar's forum, supporting the reinstatement of the domain.
Regardless of peoples' feelings about what was hosted at goatse.cx, arbitrary domain suspension due to content has potentially chilling effects. CIIA used a vaguely-worded clause in their registration agreement which allows them to disable any domain for any (or no) reason, even if the domain's operators aren't doing anything wrong and aren't otherwise in violation of the agreement. The suspension was apparently done with neither warning nor notice to the domain's owner.
Nearly all registrars maintain the right to take such action. However, to my knowledge this has never been done before, except in cases where the domain's owner was seriously violating the registration agreement in other ways - spamming, illegal activities, etc. - and even then only on rare occasions. The goatse situation essentially amounts to a web-based joe job, wherein the site's owner had no control over links to the domain or how they were used.
Until this week, I'd always been under the impression that it's a hosting provider's job to stop service to a domain. If a website contained content so controversial as to generate complaints, the hosting provider would make the decision as to whether or not to continue serving the domain. If the host declined, the domain's owner could simply move the site to a more tolerant host. And that's the way it should be.
With CIIA's action, the tables have turned, and a registrar - even if only a small player - has set a precedent for registrars playing the role of content moderator. While this could come in handy (imagine dotster.com, who are running Apache on some sort of Unix, suspending sco.com's registration just for the heck of it), it also makes the process of shutting down potentially controversial sites far too easy. What if the Public Internet Registry decides on a whim to disable landoverbaptist.org because "Landover takes parody too far for our liking," or freenetproject.org because "Freenet can be used for bad purposes," or slashdot.org because "there are too many radical thinkers on that site?"
Domain names are finite resources. If it's widely known that you can be found at example.com, and your webhost shuts you down because they don't approve of the content of your website, you can find another webhost and be back online within a day or so. But if your registrar suspends your domain because they don't approve of your site's content, you can't just go somewhere else and "buy a new copy" of your prime internet real estate. (Oddly enough, it appears that Google has decided to ignore links to goatse.cx; I'd been hoping to use the search results to demonstrate the domain's popularity, but no go.)
The finite nature of domains becomes even more of a problem with many ccTLD operators, who are frequently the sole registrars of their root domain. I should emphasize that goatse.cx was suspended, not deleted; the Christmas Island Internet Administration didn't remove goatse.cx and make it available for someone else to re-register. It's still there, and even paid up through 2005. It's just useless now, and its o
Cisco provides some basic site analysis with their Cisco Aironet program, though more in-depth analysis, as well as security aspects are not really addressed in the software package.
... here.
cheers- raga
there are really only 2 commercial vendors out there that do monitoring/management/configuration management of wireless networks. Airwave and WaveLink I have used both and would advise anyone to go with Airwave. Currently using them to management 1000+ Access Point network and working to extend that out to manage the other 5000 that are not being managed.
Well, you can buy lots of cool products that will thell you exactly where all your wireless clients are!
plus there are lots more that do other sorts of monitoring but without the geolocation angle. But I didn't just hand in a marketing assignment about them.
ettercap more useful than kismet.
I dont understand why dont all the wirless people just forget about all this crap and just say that IPv6 has to be on all the clients
so thats
win2k and winXP
linux
*nix
*BSD
MacOS X panther
the router could even understand mobileIP and then things would be sweet !
(same IP no matter where you roam)
tell me ?
regards
John Jones