RE: detecting promiscuous 802.11x cards...

But in Linux, it is a whole different story.  I was using Ethereal to
debug some routing issues with a WRT54G using a wireless nic in
promiscuous mode and noticed that I was also pulling in all kinds of
packets from other wireless cards.  I live up on scenic hill in Kent and
have LOS to most of the Kent valley so it doesn't surprise me that I was
seeing packets from other cards operating on the same channel.

That got me thinking about security naturally, and I was wondering if
there was a way that I could use libpcap and perl to make a script that
would sniff 802.11x frames to gather MACS and then interract with the
other nics in a way that would tell me if they were sniffing as well.  I
think it would be handy if you could easily detect if there is anybody
actively sniffing the channel.

I'll have to try the ARP trick against one of my wireless nics in
promiscuous mode to see if it works.  Are there any web pages detailing
the ARP test?  Specifically, I'm looking for how to mangle the ARP
properly.

Dave

-]  -----Original Message-----
-]  From: [email protected] 
-]  [mailto:[email protected]] On Behalf Of 
-]  Casey Halverson
-]  Sent: Thursday, January 13, 2005 2:43 PM
-]  To: SeattleWireless Talk List
-]  Subject: RE: detecting promiscuous 802.11x cards...
-]  
-]  Whenever I put a prism card into promiscuous mode in 
-]  Windows, it does not allow me to use the interface.
-]  

_______________________________________________
Talk mailing list
[email protected]
http://seattlewireless.net/mailman/listinfo/talk