After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data they send to my wireless router be captured for analysis?
If you're on a Linux machine, install
First, find out your netmask (should be 255.255.255.0 for a normal home network). You can do this with
If you know the IP of the intruders, you can put it between the first slashes:
You may have to wait a bit for it to load. In the meantime, open Wireshark:
Open a new terminal and run
Get the latest BackTrack (which is now called Kali) using the airmon-ng program set your wireless card in monitor mode then using airodump-ng start capturing packets on your channel. You don't have to be authenticated with your wireless router because at this point you're just getting the encrypted wireless traffic. Once you have enough traffic that you want to analyze decrypt the packets with WireShark.
PROS of this method
CONS of this method
My advice is to try this method first and if it doesn't give you the results you're looking for then go for the active approach.
You will need to use a wireless adapter and matching set of drivers that can be used in "monitor mode" (see wireshark's help page on the subject). That usually require you to use a Linux distro and to have a compatible wireless adapter: not very hard to find but oyu might not have one.
A simpler way (at least, from my point of view) would be to setup a system to act as a router between your wireless access point and your other networks (internal as well as WAN) and capture traffic from there: you'll have no need to decode 802.1* and you have plenty of additional option to have some fun with them.