Airsnort finding more stuff

stonent · 11-04-2003

I just installed Airsnort for the first time and it is finding 3 APs in the vicinity of my house. I was curious because Netstumbler never found anything except my AP when in my house. Very interesting... One has an SSID of "NETGEAR". None, other than mine have WEP enabled. Is Airsnort more sensitive?

Using latest Airsnort + Linux-wlan-ng + kernel 2.4.22-ck2 on Gentoo.

Monitr7 · 11-05-2003

NS is a "passive" sniffer, which will only detect APs that are set up to broadcast. AirSnort (utilizing Kismet?) is an active sniffer; sending out a signal that causes APs, even those that are set up not to broadcast, to send their AP info. So that's one reason you're finding more APs with AirSnort.

AirSnort is indeed more sensitive than NetStumbler. I've seen AirSnort display information on an AP long before NetStumbler does. This is due to its active nature, as mentioned earlier.

However, for what I do (rogue AP detection), I'd rather use NetStumbler, due to its ability to show a graphic representation of signal strength, wich allows for better direction-finding ops.

That's my .02. Hope this helped.

sparafina · 11-05-2003

Quote:

Originally posted by Monitr7
NS is a "passive" sniffer, which will only detect APs that are set up to broadcast. AirSnort (utilizing Kismet?) is an active sniffer; sending out a signal that causes APs, even those that are set up not to broadcast, to send their AP info. So that's one reason you're finding more APs with AirSnort.

Dude, you got it a backwards.

NS is "active" in that it sends a probe beacon, just like the client manager.

Kismet is passive, listening for traffic.

peekitty · 11-05-2003

Well, you've got it mostly backwards Monitr7, NS is actually active, and airsnort is a passive sniffer. But other than that, you're correct

peekitty · 11-05-2003

Oops, you beat me to it.

Monitr7 · 11-05-2003

Quote:

Originally posted by sparafina
Dude, you got it a backwards.

NS is "active" in that it sends a probe beacon, just like the client manager.

Kismet is passive, listening for traffic.

Yeah, I was thinking about that when I came onto the forums. Then, I read your post. Then, I beat my head against the desk. Thanks.

sparafina · 11-05-2003

Quote:

Originally posted by Monitr7
Yeah, I was thinking about that when I came onto the forums. Then, I read your post. Then, I beat my head against the desk. Thanks.

No problem, any time.

Maybe you could slam your fingers in a drawer also.

Monitr7 · 11-05-2003

Quote:

Originally posted by sparafina
No problem, any time.

Maybe you could slam your fingers in a drawer also.

Did that. Also did the old "run over my feet with the desk chair" thing.

I've also warned myself that if I give out any more erroneous info, I'll hit me with a baseball bat. There; that'll show me!

WiFiLinux · 11-05-2003

Quote:

Originally posted by stonent
I just installed Airsnort for the first time and it is finding 3 APs in the vicinity of my house. I was curious because Netstumbler never found anything except my AP when in my house. Very interesting... One has an SSID of "NETGEAR". None, other than mine have WEP enabled. Is Airsnort more sensitive?

Using latest Airsnort + Linux-wlan-ng + kernel 2.4.22-ck2 on Gentoo.

Is everything else the same? Are you using the same card for Airsnort and NS?

11-04-2003	#1 (permalink)
stonent Grrr. Join Date: Aug 2002 Location: Texas Posts: 156	Airsnort finding more stuff I just installed Airsnort for the first time and it is finding 3 APs in the vicinity of my house. I was curious because Netstumbler never found anything except my AP when in my house. Very interesting... One has an SSID of "NETGEAR". None, other than mine have WEP enabled. Is Airsnort more sensitive? Using latest Airsnort + Linux-wlan-ng + kernel 2.4.22-ck2 on Gentoo. __________________ http://home.attbi.com/~stonent Get the most out of your Dell laptop Biatch! Last edited by stonent : 11-04-2003 at 09:17 PM.

11-05-2003	#2 (permalink)
Monitr7 Not feeling funny... Join Date: Jan 2003 Location: Rebrandsoftware's mom's house... Posts: 1,699	NS is a "passive" sniffer, which will only detect APs that are set up to broadcast. AirSnort (utilizing Kismet?) is an active sniffer; sending out a signal that causes APs, even those that are set up not to broadcast, to send their AP info. So that's one reason you're finding more APs with AirSnort. AirSnort is indeed more sensitive than NetStumbler. I've seen AirSnort display information on an AP long before NetStumbler does. This is due to its active nature, as mentioned earlier. However, for what I do (rogue AP detection), I'd rather use NetStumbler, due to its ability to show a graphic representation of signal strength, wich allows for better direction-finding ops. That's my .02. Hope this helped. __________________ WTOTD Industries - Where quality is Job #3. G8tK33per doesn't care about the tarded people! -Kanye West Last edited by Monitr7 : 11-05-2003 at 05:51 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

11-05-2003	#4 (permalink)
peekitty Macaca Join Date: Sep 2002 Location: S. Florida Posts: 1,056	Well, you've got it mostly backwards Monitr7, NS is actually active, and airsnort is a passive sniffer. But other than that, you're correct

11-05-2003	#5 (permalink)
peekitty Macaca Join Date: Sep 2002 Location: S. Florida Posts: 1,056	Oops, you beat me to it.