Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the fingerprint, but they should not be the only indicators.
-
You might want to add MAC address to the list of things to exclude from fingerprinting signatures.– IsziCommented Feb 13, 2012 at 13:27
Add a comment
|
3 Answers
One interesting fingerprint you could use is the clock skew. Since 802.11 APs typically broadcast their timestamp in beacon frames, the beacon frames provide a nice source of the devices clock skew. For more details, see "On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews".
-
Just found this! Very interesting and very interesting use case– ErikCommented Feb 13, 2012 at 16:13
How do you want to fingerprint access points; through OSI layer 1, 2, or above?
If you want to fingerprint them via OSI layer 3 or above, check out http://www.hping.org/; it sounds promising - but I think its' fingerprinting abilities probably do not include access points; however, I've not tried it.
You can use nmap to carry out an element of this (if you look at the management port of the access point) - but this won't help you much if all you can see is the wireless part of the network and no ports are open on the access point's wireless network interface.
answered Feb 13, 2012 at 13:47
