Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several odd characteristics:

  • The destination MAC is broadcast (FF:FF:FF:FF:FF:FF) while the BSSID and source MAC are zeroed out (00:00:00:00:00:00).
  • There is no ESSID
  • The signal strength is relatively steady and is on par with neighboring networks, which leads me to believe this is a device in a nearby building.
  • The speed at which these frames come in is odd. While most of the neighboring networks send out beacons at a steady rate of 10 packets per second, this one triples that rate, coming in at about 30 packets per second.

Has anyone come across this before? Do you think it is most likely faulty drivers or is this a known behavior of some device?

(If you would like to see an example of a packet, check out this one minute dump, filtered by BSSID.)

share|improve this question
    
Are you aware of HTTPS://www.cloudshark.org? –  Lekensteyn Oct 5 '13 at 17:35
    
I was not. I changed the link in my question. –  hololeap Oct 5 '13 at 18:20
    
For beacons see en.wikipedia.org/wiki/Beacon_frame –  ott-- Oct 5 '13 at 20:07
    
I wasn't asking about beacon frames in general, I was asking about this specific type of beacon frame I have been seeing. –  hololeap Oct 5 '13 at 21:26

1 Answer 1

When a network device uses a value 00:00:00:00:00:00 as a MAC-address, it is being used as multicast address, however the request will be proceeded by all devices which would receive it (so the machines in the multicast group).

Your description doesn't provide sufficient detail to otherwise infer what might be happening, however we can guess reasonable restrictions.

It likely isn't an attack since:

  1. an active dictionary building attack on WEP would be obvious through artificial traffic generation and wouldn't appear as multicast

  2. An active attack to inject traffic from an unauthorized mobile station would use its own MAC or decoy another legitimate MAC rather than multicast

  3. An active attack to decrypt traffic targeting your access point wouldn't use a broadcast, but target your access point, and you'd see increased outbound traffic from your access point (the goal being to see it try to initiate connections enough times to crack the WEP key)

  4. A Passive attack would be silent, so go undetected.

Though there's too little to infer exactly what's happening, an educated guess might be access point misconfiguration. Can you tell us if this behaviour is new, intermittent or what? (And yes, packet capture some of this if you can and share it)

share|improve this answer
    
Whatever is broadcasting these packets is still running and hasn't seemed to have stopped since I posted the question. I walked around with my laptop trying to determine the source of the signal, but it seemed to be coming from inside someone's house. I have also noticed the same pattern in different locations in different towns but did not take the time to locate them. There is a PCAP dump at the bottom of my question if you want to take a look at the packets. I used the Wireshark filter, "wlan.bssid == 00:00:00:00:00:00", and exported the displayed packets. –  hololeap Nov 30 '13 at 3:48
    
It's really starting to sound something like a Netgear device. See: documentation.netgear.com/gs700at/enu/202-10360-01/… –  user34445 Nov 30 '13 at 19:27
    
Also, I've seen other sites talking about Netgear broadcasting multicast packets just as you describe. Still betting, one of your neighbours has a misconfigured Netgear. –  user34445 Nov 30 '13 at 19:37
    
From your packets, it appears to be a beacon frame Delivery Traffic Indication Message (DTIM) for an 802.11b wireless access point, but I'm not an 802.11b expert. I get that from the FrameControl Field, and the Flag 0x00 seems to suggest the AP is working in AD-HOC mode so willing to bind with anything (hence no SSID). If that's true, the 'threat' here is that you bind to it unknowingly. –  user34445 Nov 30 '13 at 19:52
    
We know its an Access Point from the "IEEE 802.11 wireless LAN management Frame with 0x0401" set (ESS capability, transmitter is an AP is TRUE) –  user34445 Nov 30 '13 at 19:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.