[kismac] Re: More about SSID and Network Type...


So, will Kismac take the SSID from these alternative places as well as the beacon?

Yes.

Will the Mac Address shown for a probe entry be that of the probing network interface or the network access point detected via the response to the probe?

the interface. since the target network is usually "any".

there are also "tunnel" networks, which are point to point connections, often referred as WDS.

Will Kismac detect these?

Yes.

no ssid means there have been no beacon frames to examine. hidden ssid means that there have been beacons, but the ssid field has been wiped out. kismac shows blank if the recieved ssid consits of spaces or non printable characters.

Will the <hidden> marker be replaced if the SSID shows up in other types of frames, and which?

probe responses. association requests. reassosiation requests. (hint use deauthentication for a short term to force clients to login again)

Under what conditions can the network type be blank?

if the owner sets it to space or blank, it is not a special handler.

kismac only shows probes if there are a lot of them in a short term. this is generally an indication for a running active stumbler. however there are also some "legal" tools, which make an excessive use of probes

Can you say what some of these tools are?

Windows utilities which come with wireless device drivers.

Why do you imply that Kismac is not a "legal" tool?

KisMAC is legal by law in any country i know of. But it might not be legal by company policy, that is why the quotes. It is at least nothing which i want to see around at a network which administer.

I would think it really depends on what one does with the information they gather from Kismac and that Kismac can be used for good, legal purposes, or to aid in illegal usage of networks. And I do know there are features to help crack WEP, but I would never use them on someone's network, as I take it that feature is for me to check the security of my own network if I want to know how quickly one could break in or for professionals who are hired to check the security of a particular network.
I am curious though how it would be regarded legally if someone used Kismac while traveling to see if there is a network around and happened to find a network with WEP turned off and then used it to reach the Internet for some light duty (low data volume), legal web surfing or email checking without checking whether the owner intended to share the network (or was merely incompentent to not secure his network).

You are completely legal with that.

Is there a way to save the list of networks generated into a tab or comma delimited text file? What about the information concerning a network's clients?

Nope. May be in some other version.

How about an easy way to add waypoints to mark where one is on the road, while scanning. Perhaps almost any keystroke during a scan could begin an entry of a new data line on the screen called a waypoint and the characters typed would appear in that line as a label to name the waypoint until another network is encountered, which would close the entry of that waypoint. Then any characters typed would start a new waypoint marker. If one is scanning while driving a car, one could just reach over and hit any key without looking and remember where they were at the time they typed garbage, or if one is stopped at a traffic light, they could look and type a few meaningful keys abbreviating where they are at.

I do not really get what you mean. Do you use the term waypoint in the way it is used in KisMAC? Or do you just think of it, like the way it is used in GPS recievers?

mick

p.s. Think of the people, who do not receive these mailing list as a daily digest and write only one message within an hour.

Other related posts: