Jeff Duntemann's Wardriving FAQ

Part IV: NetStumbler

FAQ:  | Part I | Part II | Part III | Part IV | Part V | Part VI | Part VII |

Emphatically not. Netstumbler is a good and courteous listener. It only records those elements of data that the access point (AP) makes public. It has no machinery for sniffing packets, reverse-engineering passwords, or even connecting to an unprotected network. Furthermore, NetStumbler respects the wishes of network owners in terms of the public visibility of their networks: If the owner of an AP disables the AP's beacon broadcast, NetStumbler will not detect it.

NetStumbler has three major uses:

• Wardriving, as described earlier in this FAQ.
• Detecting rogue access points in large networks used by many people. A rogue access point is simply an access point that has been connected to a network without the permission or knowledge of the network administrator. These are a hazard in a number of ways, but primarily in that they are connected behind the company firewall and thus short-circuit most of the network's security technology. (As someone said on the NetStumbler forums, it's like hanging a category 5 network cable out the window down to the parking lot.) To find rogue access points, an administrator simply walks around the area where the network reaches with NetStumbler running on a laptop or MiniStumber on a PDA. If any access points are in the vicinity of the network, NetStumbler will report them, and the network administrator can remove them if they're not an official part of the network.
• Directly sensing the coverage of an AP's radio field. NetStumbler includes a high-resolution field strength and signal-to-noise ratio display. By walking around with a laptop running NetStumbler, you can find weak spots and dead spots in an AP's coverage, as well as determine with fair accuracy the outer limits of an AP's useful range. NetStumbler is also useful in testing the relative effectiveness of Wi-Fi antennas, by placing a laptop running NetStumbler in a fixed position, and then aiming antennas at it from some distance away. If the antennas are all at the same distance from the laptop, NetStumbler's readings will accurately reflect how well the antennas work with respect to one another.

NetStumbler author Marius Milner actively enhances the product, adding more supported client adapters on a regular basis. He posts a list of supported client adapters in the readme file for the NetStumbler software. This readme file is included in the NetStumbler download archive, but it's also posted on the Web. This is the first place you should look to check for specific client adapter support.

On the other hand, there are similarities in drivers and in client adapter hardware, and often an adapter that is not on the official "supported" list will be similar enough to a supported adapter to work. This whole business is made worse by the fact that some adapters will work using Windows XP drivers and won't work using drivers for other operating systems. If you have an adapter that isn't on Marius' supported list, try it! This is especially true if you're using Windows XP. Your chances improve if you have the latest firmware loaded on the adapter, and also the latest OS drivers from the manufacturer.

Much discussion of this issue happens on the NetStumbler Forums. I advise using the Search function to look for the names of specific cards that you're interested in. Use Search. Don't just post a question that may have been asked and answered fifteen times already.

There is no one answer to this question. The way to approach it is to look at the four variables that govern a client's suitability for use with NetStumbler. I list them in their order of importance:

1. Technology. 802.11b is the only wireless technology supported by NetStumbler. 802.11a and draft 802.11g do not (currently) work at all. TI's 802.11b+ chipset has been reported by some to work, but my experiments with D-Link's DWL-650+ PC card have not borne this out.
2. NetStumbler compatibility. As I mentioned above, not all 802.11b Wi-Fi clients work with NetStumbler. You'll have to check Marius Milner's list of supported cards regularly, and monitor pertinent traffic on the NetStumbler Forums.
3. Antenna jack. Although not strictly required, it's very difficult to get effective results with a laptop using a PC card's tiny integrated "bulge" antenna. A fairly small cohort of PC cards has a tiny coaxial jack into which you can plug a coaxial connector leading (via a short run of coaxial cable) to a vertical antenna on top of your vehicle. My experiments have shown that using a PC card's integrated antenna alone will gather only 50%-60% as many stations as a vertical antenna outside the vehicle.
4. PC card receiver sensitivity. Some (but by no means all) manufacturers of Wi-Fi PC cards publish a receiver sensitivity figure in dBm. This figure specifies the amount of radio power that must be delivered by the card's antenna to the receiver circuitry for a station to be effectively received above the noise. The number is usually from -80 dBm to -90 dBm. The larger the number, the more sensitive the card, because the values are negative. -90 dBm is less power than -80 dBm, so if a receiver can pick up a signal at -90 dBm, that's better. (Such receivers are rare. Most fall in the -80 dBm range.) Caution: Sensitivity is something to consider, but only if the card is known to be compatible with NetStumbler. In practice, differences of a few dBm will not be significant in terms of numbers of stations logged.

The bottom line is that you need a card that works with NetStumbler and also has a jack for an external antenna. The most commonly used cards that meet both of these criteria are the Orinoco Silver and Orinoco Gold. Most people use the Gold card; the Silver card is identical except that it only supports 64-bit WEP, which doesn't matter for wardriving. If you don't already have a PC card adapter, get the Orinoco Gold card; it's cheap, reliable, and completely supported by NetStumbler. Another reason to use the Orinoco PC cards that is not widely known is that their firmware discriminates against something called "weak IV" values. Weak IV values are one way that crackers break into wireless networks. I explain this in detail in my book; it's off-topic for a wardriving FAQ, but weak IV discrimination is a very good feature to have in a Wi-Fi client adapter and access point.

NetStumbler accepts GPS data through any of the PC's serial ports. Note that "serial" does not mean "USB" here; NetStumbler only accepts serial data on COM ports. (There is a dodge around this that I've used; see below.) In terms of GPS data formats, the older versions of NetStumbler only accepted NMEA (National Marine Electronics Association) 183 data. The latest version will also accept Garmin Binary, Garmin Text, and Tripmate formats. Any GPS receiver that can emit one of those formats should work with NetStumbler. You select the COM port and the GPS data format from the GPS tab of the Options dialog. You bring up that dialog by selecting View|Options from NetStumbler's main menu.

GPS receivers that communicate primarily through a USB port often come with "port bridge" software, which is an installable utility that "maps" a USB port onto a COM port. The receiver still reports its data through the USB port (and draws its power from the USB port, which I consider a big plus—fewer cables!) but the bridge utility also sends the data to the COM port driver. Software like NetStumbler that listens for data on a COM port can thus acquire data from a USB receiver. Marius has indicated that he intends to expand direct USB support of GPS over time, so you need to watch for updated releases of NetStumbler.

FAQ:  | Part I | Part II | Part III | Part IV | Part V | Part VI | Part VII |

)( © Copyright 2006 All rights Reserved WardrivingOnline.com )(
View the SiteMap