Jeff Duntemann's Wardriving FAQ

Much of the material in this FAQ is adapted from my book, Jeff Duntemann's Drive-By Wi-Fi Guide. ISBN 1-932111-74-3 $29.95. If you found this FAQ useful, please consider buying the book. It's the only Wi-Fi book out there that covers wardriving at all, and does so in great detail, far more detail than I can provide in this one FAQ.

I am always looking for errors and omissions—I try to be everywhere and see everything, but it's a big job and getting bigger all the time. If you spot a mistake in this FAQ, or wish to suggest something that should be included, please email me at the email address below:

......................................................

I try to answer all email but bear with me if I get behind!
For Definitions of any wardriving related words that you read below and don't understand, visit our
Wardriving Dictionary!

Part I. The Basics

What is wardriving?

Wardriving is the gathering of statistics about wireless networks in a given area by listening for their publicly available broadcast beacons. Wireless access points (APs) announce their presence at set intervals (usually 100 milliseconds) by broadcasting a packet containing their service set identifier (SSID) and several other data items. A stumbling utility running on a portable computer of some sort (a laptop or PDA) listens for these broadcasts and records the data that the AP makes publicly available.

When you wardrive, you drive around in your car while running a stumbling utility, and record beacons from nearby APs. Most stumbling utilities have the ability to add GPS location information to their log files, so that the geographical positions of stumbled APs (often called "stations" by insiders) may be retained and plotted on electronic maps like those produced by Microsoft's MapPoint software.

The overwhelming favourite among stumbling utilities is called Network Stumbler (informally, NetStumbler) and this FAQ will focus primarily on the use of NetStumbler. Other stumbling utilities exist, and I will provide pointers to them later on.

Wardriving as we know it was first developed by Pete Shipley in April 2001. Others had run around with laptops, sensing AP beacons and taking notes (often on paper!) but Pete was the first to automate the process with dedicated software, and also the first to integrate GPS location data with databases of detected APs. What put wardriving on the map, however, was Marius Milner's NetStumbler utility, which is by far the most widely used wardriving utility. More—lots more—on NetStumbler later in this FAQ.

Why "war"?

This is kind of an unfortunate prefix, in these rather twitchy times. Wardriving has nothing whatsoever to do with war. The term is the offspring of the term wardialing, which was the (now mostly extinct) practice of dialing random phone numbers via computer to see if you could find an answer modem. Wardialing, in turn, came out of the 1983 cult movie War Games, in which a teenager got himself (and the rest of the world) into serious trouble by creating an autodialer that eventually found its way into a DOD computer programmed to wage nuclear war. The kid was looking for computers supporting online games and had no strong intent to "break into" anything—the problems that developed lay with an essentially undefended military computer.

If I were the one coining a term, I'd coin something else, but the word is out there and we're using it.

Why is wardriving useful?

Wardriving provides a unique opportunity to gauge the growth of a technology market segment by direct inspection. In other words, we don't have to take a vendor's or research firm's word for how many wireless networks are out there. We can go out and look for ourselves. This isn't possible for things like digital cameras and DVD burners. In conjunction with some understanding of the demographics of an area, it's possible to use wardriving data to get a sense for how "connected" or "tech savvy" a neighbourhood or region is.

This sounds dull, but in fact wardriving is fun in the sense that a scavenger hunt is fun: You never know what you're going to find when you go out, and you expect to be surprised. The wardriving community is (as you'd expect) heavily connected via the Internet, and you can meet a lot of interesting and extremely skilled network and radio people by becoming part of the community. There is a lot of sharing of technology knowledge within the community, in things like network configuration and troubleshooting, antenna construction, cabling and power infrastructure, and so on. Even though I've been a licensed radio amateur (ham) since 1973, I tripled my knowledge of microwave radio techniques by taking up wardriving.

Do you have to drive a vehicle to wardrive?

Not at all. In fact, in extremely dense urban cores like that of New York, Washington DC, London, and Paris, it's much more effective to simply walk around with a Wi-Fi equipped PDA in your pocket running a stumbling utility like MiniStumbler on a PocketPC or Kismet on a Zaurus. People have reported stumbling while riding bicycles and flying airplanes. (In the air, it helps not to get too high.) What to call these activities is unclear, so most of us just hang "war" on the front of however we happen to be traveling. I go "warcabbing" when I travel and don't rent a car, by opening my laptop in the back seat of a taxi.

What do I need to have in order to wardrive?

What most wardrivers call their "wardriving rigs" include the following:

A computer you can haul around with you. Most people use laptops. Some use PDA's based on the PocketPC OS or Linux.
A "stumbler" utility. By far the best known is Marius Milner's Network Stumbler for Windows, which most people call NetStumbler. Most major operating systems have stumbler programs available. Linux has Kismet; MAC OS has MacStumbler. Marius has ported NetStumbler to PocketPC, for which it's called MiniStumbler.
A Wi-Fi client adapter supported by your chosen stumbler utility. By far the best and most widely supported client adapter is the Orinoco line of PC card adapters, now manufactured by Proxim. The Orinoco line is inexpensive, very sensitive, and unlike 90% of PC card Wi-Fi adapters, has a small jack for attaching an external antenna.
An external antenna attached to your client adapter. Ideally, this is an omni-directional vertical mounted on the vehicle roof. These are small and resemble cell phone antennas. You can wardrive with nothing more than a PC card's built-in antenna, but these antennas are wretched and (being inside the vehicle) will be shielded from signals to some extent by the vehicle's metal structure. Note well: I do not think that Pringle's potato chip cans make good wardriving antennas, but they're, well, legendary.
A GPS receiver that emits NMEA 183 formatted data. This allows the stumbler program to record where stumbled stations are located in the physical world. Technically, GPS is optional, but the stumbled data is much less useful without GPS information.

I'll cover most of these points in more detail later on in this FAQ; specifically, Part III.

Where can I find more information?

Some suggestions:

Keep reading this FAQ! (Lots more below!)
Have a good look around this site!
Two chapters in my book, Jeff Duntemann's Drive-By Wi-Fi Guide, are devoted to wardriving and interpreting the data you gather while wardriving. The book is published by Paraglyph Press. Its ISBN is 1-932111-74-3. 474 pages, $29.99.
Visit our wardriving forum Here.
Monitor Marius Milner's Stumbler.net blog. Marius is the author of NetStumbler, the most widely-used stumbling utility. His blog contains notes on release levels for the program, new support for Wi-Fi client cards, and other things.

Beyond that, well, just Google around on the Web. The term "wardriving" has only one meaning, so you won't get a lot of false hits. Many individuals have posted enthusiast sites on wardriving, and you can learn something from almost all of them.