How much information can be gathered about a network without connecting?

Question

I'm working on a project that ideally needs to be able to identify local wifi networks, and be able to recall them if they are approached again. Is there any unique identifying information that can be gathered about a network without needing to actually connect? Are there any potential legal issues that could come from this kind of passive data gathering?

Answer 1

Using a sniffer on monitor mode you'll be able to capture:

• MAC address of an AP
• Level of protection 'WPA2, WPA, WEP, none'
• MAC addresses of the clients connected to a specific AP
  

That process is called Passive sniffing, you can apply it with Airodump-ng tool on Kali.

Answer 2

On a linux distribution with a wireless interface operating in monitor mode, the following command...

airodump-ng --wps --manufacturer -- uptime -w prefix_for_log_files -i monitor_interface

...will capture the

• ESSIDS
• BSSIDS
• Crypto strength and authentication scheme (Pre shared Key vs EAP/Radius)
• Signal strength
• Whether WPS is being used on the router
• the manufacturer of the MAC addresses broadcasting
• the uptime of routers detected
• the MAC addresses of any wireless clients in range,
• Client association with any access points in range.
• ESSIDS/BSSIDS of access points that clients have previously attached to (for example, the device owners home router, hotels that they have used wifi at, etc)

This command will also write (-w) the captured data to a set of log files in xml, kismet, and csv format, as well as a dump of all traffic encountered in a .cap file. These files will provide First Seen / Last Seen times for each access point or wireless interface which has been detected, along with the highest detected signal / noise ratio (so for example you could deploy this to track people walking past your house with a very high degree of accuracy - provided they have wifi enabled on their phones, which is highly likely.)

As you can see, this simple command captures a great deal of information. Airodump-ng skips through channels by default, but this is generally measured in mili-seconds and what I have typically found is that any wireless device which is within the stated wifi standard range for more than a second will be found. Other devices two to three times further away will also typically show up within a few seconds / minutes too, depending on other ambient noise and reflections.

Airodump-ng will do this COMPLETELY passively, without broadcasting any detectable traffic at all, so can be safely considered indetectable.

The only danger of discovery of which I am aware is airodump-ng being attacked by a skilled attacker within range. Airodump-ng is on record as having been vulnerable in the past to buffer overflows, although this was patched AFAIK. However that does present the probably extremely slim chance that the airodump-ng instance you run can be exploited by a skilled attacker within range. I am certainly not aware of any exploit like this in the public domain at present with the latest version of airodump-ng.

Regarding the legality - usual caveats IANAL but as I understand it, in the UK at least, running airodump-ng is legal. I have this on the 'authority' of a penetration testing team who did a demo for my work recently, and who - they say - sought extensive counsel on this very topic. The long story short according to them was that you stray from legality when you use the captured data to run a cracking attack on another parties wireless crypto. But I would assume that also extends to capturing such data as would prove useful in a cracking attempt in preparation for such an attempt also - where it could be proved beyond a reasonable doubt that this is what you were up to.

I have spent some time with airodump-ng and cannot recommend it enough for wireless audits of the kind you have described.