Re: How to scan for SSID?

On 1/16/06, [email protected] <[email protected]> wrote:
> Quoting mobiru <[email protected]>:
> > iwlist doesn't know how to talk to prism cards.
> >
> > Perhaps you could ask someone what the ssid is?
>
> Sometimes that works, but sometimes it doesn't.  Imagine going in to Joe's
> Coffee & Donuts and asking the part time clerk for a large coffee, a glazed
> donut, and the name of the SSID for the free wireless. :(
>
> > There is a scanner utility called kismet that will work with wlan-ng
> > devices.
>
> Thanks for the suggestion.  I also received off-list reply indicating
> that Airsnort could do it.  It seems bizzare to have to install hacking
> tools to do something so mundane as get a list of SSIDs in the area,
> but if that is what it takes, what else can you do, right?  It beats
> rebooting into Windows.
>
> Mark S.

Sorry about that off-list reply.  I had intended to send it to the
list.  Just checked the the mail headers and the list email address
was under the CC field so I should have hit "Reply All".  Anyway, here
is the message I sent if anyone is interested.
--------------------------------------------------------------------------------------
I have the same card (sweet card isn't it?), but when I run a scan
using iwlist it just tells me "No scan results".  Though I do have
version 0.2.3 of the drivers (don't know what version you have right
now).  The tools I have been using to scan for networks are Airsnort
or Kismet.  Airsnort is easier to use if all you want to do is find
nearby nodes and Kismet is better for WAR driving (if you are a
security guru).  You can also manually put the card in monitor mode
and sniff for packets with Ethereal, but that is a little overkill for
your needs.  I had read when I was first learning the wlan-ng drivers
that they don't have full support for the Linux wireless extensions
API.  Since you can't configure and activate/deactivate the card via
iwconfig I would imagine that iwlist would be unable to manipulate the
card enough to scan the air for nodes.

To scan with Airsnort:
1 - login or su to root
2 - configure your wireless card to use SSID ANY (note: SSID="") an
empty string
3 - start airsnort
4 - select whether to scan all channels or listen to a specific channel
5 - select your network device and driver type (defaulted to wlan-ng for me :-)
6 - press "Start" to begin sniffing for wireless nodes

Airsnort also features a WEP cracker which can be used to test your
encryption keys.  Ask permission before you try and crack someone
else's traffic because this can get you in hot water with the law.
Here in Ohio some guy from West Virginia decided to park in front of a
car dealership and check his email in the middle of the night.  A cop
got suspicious of this vehicle sitting there and asked him what he was
doing and the guy told the truth.  The dude got arrested and convicted
because he had gained "unauthorized access" to a computer network so
therefore he was a "hacker".  Funny thing though, they weren't even
using WEP and any wireless card configured to associate with "ANY"
access point would have automatically created a connection!  It was
never this guy's intent to "break in" to any one's network and the
extent of his "damages" was using their idle bandwidth (I doubt a car
dealer pays by the MB for Internet).  Besides, if they had used plain
old WEP it would have been like duct taping your front door shut to
deter a thief.  WEP has been thoroughly cracked for a long time, and
now there are now methods to crack it even faster than before
(airsnort still requires about 10 million packets).  Anyway, enough of
my rambling, go snag airsnort for now.  It will do what you need.
Also, you mentioned you have a "Red Hat" distro.  I have Fedora 4 and
I found airsnort prepackaged on the Fedora Extras yum repository.  You
should be able to find a binary package just as easily if you have a
different distro.