WiFi stuff

Here is documentation on how to use monitor mode under FreeBSD/Linux. Currently only 802.11b is covered.

Applications

tcpdump

The venerable network tool. Some useful filtering expressions:

Only show frames from a specific access point: ether host 01:02:03:04:05:06
Filter for 802.11 infrastructure packets: link[0]=0x80
Filter for 802.11 data packets: link[0]=8
Filter for 802.11 data with WEP: link[0:2] & 0x0842 != 0
Filter for ARP packets: len==68 and ether dst host ff:ff:ff:ff:ff:ff

dsniff

Patch to allow reading previously captured files

ssidsniff

A curses based tool that allows identification, classification and data capturing of wireless networks. The interface is inspired by the unix top(1) utility. Currently it works under Linux.

Dependencies

libpcap Version 0.7.1 and above is the bare minimum. With version 0.9.5 the support for wireless interfaces is comprehensive, therefore it is highly recommended.
Curses/ncurses. This library should come with your operating system.
A wireless card. Monitor mode will be setup automatically.

Availability

ssidsniff-0.53.tar.gz Detect WPA, WPA2, extended rates (802.11g etc); adaptive hopper that spends more time on chatty channels

ssidsniff-0.52.tar.gz Last seen activity support; enumerate network clients; prism header support

ssidsniff-0.50.tar.gz Support wireless signal power; libpcap 0.9

ssidsniff-0.47.tar.gz Added pagination, ALSA support

ssidsniff-0.46.tar.gz Made pcap filter work again, minor bugs fixed, documentation fixes

ssidsniff-0.45.tar.gz Included channel hopper

ssidsniff-0.44.tar.gz Parser bugfixes

ssidsniff-0.43.tar.gz Ported to Debian etch: Support for gcc 4.1, libpcap 0.7

ssidsniff-0.42.tar.gz Bugfixes

ssidsniff-0.41.tar.gz Curses efficiency, updates to 802.11 parser, fixes

$Id: index.html,v 1.37 2007-07-22 20:07:59 kos Exp $

ssidsniff-0.53.tar.gz	Detect WPA, WPA2, extended rates (802.11g etc); adaptive hopper that spends more time on chatty channels
ssidsniff-0.52.tar.gz	Last seen activity support; enumerate network clients; prism header support
ssidsniff-0.50.tar.gz	Support wireless signal power; libpcap 0.9
ssidsniff-0.47.tar.gz	Added pagination, ALSA support
ssidsniff-0.46.tar.gz	Made pcap filter work again, minor bugs fixed, documentation fixes
ssidsniff-0.45.tar.gz	Included channel hopper
ssidsniff-0.44.tar.gz	Parser bugfixes
ssidsniff-0.43.tar.gz	Ported to Debian etch: Support for gcc 4.1, libpcap 0.7
ssidsniff-0.42.tar.gz	Bugfixes
ssidsniff-0.41.tar.gz	Curses efficiency, updates to 802.11 parser, fixes