Slashdot Mirror
Build an Open Source Network Sniffer
An anonymous reader writes "This article reviews common issues of wireless security, and shows how to use open source software to suss out wireless networks, get information about them, and start recognizing common security problems. You will learn how build a lightweight wireless sniffer that runs on open source software and see how simple it is to interact with wireless networks."
Rather than yet another wireless sniffing tool, what I really want is a linux firewall that sits between my wireless router and the rest of the world that tosses traffic from unauthenticated IP addresses (you could authenticate with, say, ssh or perhaps by hitting an SSL protected web form). Until the newly connected machine authenticates itself the firewall would squelch all outgoing traffic. It seems like this wouldn't be too hard to write, but before reinventing the wheel has anyone heard of such a thing? It would at least help keep random people from using our wireless network to surf the web (it is already outside of our firewall to help protect the rest of our network). I am all for allowing freebie wireless access to the masses, but I am not too keen on letting Joe Wardriver download kiddie porn from our work DSL either. This kind of tool seems like it would be useful to use in conjunction with a lowend wireless router.
I Am My Own Worst Enemy
It is, however, a pretty neat text-only interface to enumerate broadcasting APs, and honestly, the code for the interface makes for more interesting examination than the code for the 'sniffing'.
This flies in the face of science.
just get a WPA-enabled wireless router?
Has anyone actually looked at the cost of commercial "Sniffer" devices? Network General (Formally Network Associates) sells a version that is outragiously priced. Granted, it does have additional functionality, but all you need is a Sniffer. I wonder how a company can sell such a half-assed product, and why people would still buy it. Ethereal is a really nice "free" program to use, and there are many other ways to get a NIC to display everything flowing through it.
WPA w/ a radius server running on that linux box.
I have bookmarked it. This is the kind of crap I love. I just today acquired a Cassiopeia E100 for free, and I'm going to a)install Linux on it, and b)see if I can get wireless running on it. This is gonna be awesome.
My favorite software slogan ever is for ethereal, "Sniffing the glue that holds the internet together"
I'm sure a lot of you know this but this is in reference to TCP/IP being called "the glue that holds the internet together" Oh so funny. And oh so off-topic. I'm sorry. I love you guys.
Please stop stalking me, bro.
I wonder which freeway it was. I drived Montreal down to Dover DE, crossing Newark NY and Albany NY and I left kismet open and I never picked a signal. Maybe I was driving too fast. ;-)
Achille Talon
Hop!
Its sold as a "router", but what it really is is a little plastic box with a 200MHz MIPS embedded computer running Linux. You can replace the firmware with something like Sveasoft's modified version, that allows you to SSH into it, and run something like Snort on it. You can turn off the onboard wireless card if you don't need it, and disconnect the antennas for an even more compact device. Without the radio going, it probably won't even put out much heat.
/usr/games/fortune
Get a Linksys WRT54G (no need for GS even, you're just going to use it for sniffing), stick openwrt on it, put kismet_drone on it and off you go. Gives you your wlan traffic over good old Ethernet, and costs something like $65 nowadays.
/proc you are doing and finally might or might not show you all the packets since the firmware hides them from you.
Or you can buy a $30-50 card for your PC which might or might not be able to do monitor mode depending on your drivers, and might or might not reliably go into monitor mode depending on the exact sequence of iwconfig/ifconfig/catting stuff into files in
Of course if you're running around with a laptop the Linksys option is a bit tricky since you need to feed power to it. For basic indoor problem-solving it's unbeatable. Unless someone comes up with a reliable source for prism2.5/3's.
Still need to find a good 802.11a solution though.
You forgot... "c) Take over the world!"
After the article yesterday (the day before?) with the Altoids tin MP3 player, I thought this was going to be another project like that and got my hopes up. Oh well. :)
------ Free Mac Mini! Better than an iPod! h
There's a paper which discusses the problem quite well: http://luca.ntop.org/Ring.pdf
The thing which I found surprising is how awful Linux stood up to the tests. The standard Linux kernel + stack was dropping the majority of packets; and only with special tweaks was it able to get to capturing 93% of the packets. But 93% still isn't 100%, which is what commercial sniffers have been doing since the DOS days.
So the bottom line here is:
1. Don't use off-the-shelf BSD or Linux without serious tweaking.
2. Even then you'll still be dropping packets.
What is also interesting is that MS Windows isn't close to supporting this type of technology, which means the MS servers are going to be in serious trouble as more people adopt Gigabit networks.
Here, I would like to call everyone's attention so people get rid of the cloth in front of the eyes and see the real status: some do NOT provide info, like Conexant for their new generation prism54 (Intersil did for the first gen), Intel for their 2100 or 2200 chips or TI for the acx100. Others provide binary only drivers, like Atheros (dig in the OpenBSD source, they reverse engineered the atheros hw abstraction layer). If they do not want to help at all, fine, but do not say they are nice for PR reasons.
For me "Open Source Network Sniffer" covers the full kernel and the apps used for the sniffing. Please, think twice before affirming something is open source (binary drivers are not, even if the stub code is open source) and also that the company is open source friendly (provide help to Linux, *BSD and similar coders, maybe even the driver, is). At this moment, the only few I know that still are pro open source drivers, or even provide support (if my investigation isn't wrong), are Realtek and Ralink (and Intersil, but it doesn't exist anymore).
And for those that think binary is better than nothing... then why *BSD or Linux at all? If it starts with "but is wifi card" or "well, it is only the video card", I don't see why not apply that logic to the OS anyway, or all the apps too.
Thanks for your attention.
all I am after, is a simple tool to switch networks on the fly... I can make wireless work great, but if I don't connect to the network I want the first try, I am stuck...
kismet requires special drivers to scan, but if you figure that winxp comes with a simple interface for this built-in, it's kinda depressing that we can't seem to build a good tool that can do that, list the available networks, and give a good connect to them.. (without beating my head on the kernel modules, been there, it hurts, especially when you go to upgrade the kernel) so anyone know of anythign simple that a newbie who's been around too long to be a newbie, like me hasn't found yet? that's been what i've been digging around for a while to find...
currently using a dell truemobile 1150 pcmcia, and fedora core 2... kernel is 2.6.8-521.. off the top of my head, I think that's right, but is there a universal solution? that's the real question...
"...and I am _not_ intoxicated... YET!" --John Wayne
I'd prefer to build an open source panty sniffer.
Start by obtaining a beagle.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Windows users love to rub in how easily their linksys tools do this for them... I want an equivalent for my Ubuntu box.
I am the new wave of Linux users- "the more GUI the better" (TM).
Open Source Sushi
When I see sniffer I think something that captures packets and does at least a basic protocol decode on them (ie. SnifferPro - overpriced though it is, or Ethereal - great free package).
Am I missing something or is this just a OSS tool to enumerate wireless networks?
I don't understand why this project needs the magic of threads instead of just sockets.
You forgot... "c) Take over the world!"
;-)
I would need the E105 for that. 16MB of memory is just not enough in practical application.
Please stop stalking me, bro.
9 July 2003: this link
/ 07 /08/0043259 ... and Slashdot itself covered AirTraf and the commercial instantiation with hardware appliance, by Elixar, Inc. (now defunct) but AirTraf is still GNU.
http://mobility.newsforge.com/article.pl?sid=03
Move along. These are not the droids you seek. They can only remember what they know in the past 6 months. Maybe.
What's up with tcpdump and friends, snort, kismet, bsd-airtools and ethereal anyway?
I find your ideas intriguing and I wish to subscribe to your newsletter.
Packet sniffing linux is not build to do it by default.
7% loss is normal even for comerical on high speed cards. Some packets never make it threw a network due to outside causes ie interferance.
100% can be achived but takes a very special setup.
A system that is good a Packet sniffing also has the bad habit of being effected by network traffic that is not going to it.
Ie the problem is that network drivers drop alot the linux firewall drops more. Ie invalid/not required data is droped 64 and 512 not very often contain data so linux drops them ie 64 is ideal for a DOS attack small and can send lots of them quickly.
Note the computer size and type effects the scanning most cases a amd64 with a kernel build for amd64 handles network sniff ok.
Kismet is an excellent wardriving tool for Linux, which will even run on your PDA.
For those of us interested in maps of what wardrivers have found in your neighborhood, check out WiFiMaps.com.
Zhrodague.net - I do projects and stuff too.
Or use www.openwrt.org which is free and much more versatile and powerful.
Outbound traffic is called 'egress filtering' (yes, you need to know that so that you know what to google for ;) )
And yes, it is possible through the iptables stateful firewall (older version used ipchains).
If you don't like managing your firewall rules by hand, there are plenty of perl scripts (bash shell scripts can be klunky and slow) to manage this for you.
This is also one method to add the myriad of anti-peer-to-peer addresses that keep growing day by day.
I love IPCop, and not just because Phil is a heck-of-a-nice guy. It has great features and the blue interface for wireless is great.
If you come across my access point, I'll give you an IP-address (I'm a friendly person), and that's where it will end. The server end is completely firewalled, except for port 1194 running openVPN.
Only if you have a certificate signed by me, you will get a tunneled IP-address allowing you to access to both the internal LAN and the internet (and the server itself).
"It's too bad that stupidity isn't painful." - Anton LaVey
My brother learned a lot about the development of the Internet at a "Point and Click Linux" seminar. It turns out that IBM has given birth to many huge advances by donating time and material again and again. I don't have the specifics, but the information is out there.
And now they're releasing 500 patents under open licensing. I love IBM.
Please stop stalking me, bro.
Yes, a specialized kernel is needed. Yes, some other kernels, maybe QNX, might be better than plain vanilla BSD or Linux kernel. Yes, MS Windows isn't even anywhere remotely close to supporting this kind of technology. But...
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
He wants to sniff some open sores.
Anyone know how to go about building one of these?
Do a google search on 'PRI Tester' and you'll find dozens of hand held devices that run about $3K. I'd like a laptop with a ISDN PCMCIA card running just a simple stack to sniff what the other end is transmitting.
Yeah, yeah, yeah, I'll look around on my own.