Creating a wireless sniffer

[amyas82]

hello everyone,

i am currently trying to design a windows based gui that sniffs out networks and their details ( for research and security purposes) but i'm not sure which lnaguage to code it in.... could anyone give me some direction...?


Tanx
Amyas.

[M/Q]

Well, I guess you might be better served by checking out this link as it is a very popular application that does exactly what you want to create. They have a forum that the developers frequent, and you could ask people who have appproached the same subject.

http://www.netstumbler.com/

[WolfJT]

Ethereal is the way to go. It is a free network sniffer and will allow you to sniff you're wireless LAN in promiscuous mode.

[amyas82]

thanks guys but i am aware of these applications , i am just doing my dissertation for university and i wanted to create one of these wireless sniffers and to code it, and cater it towards a specific client that we have been given.. just to be individual i guess

anything else would be fantastic...

A

[M/Q]

I guess that is why I suggested looking at the forums that are dealing with that very subject.

I found this at one of them.

http://www-128.ibm.com/developerworks/library/wi-rfsensor.html?ca=dgr-lnxw06OS-Sniffer

[Specialist927]

Some wireless sniffers access wireless card information in monitor mode on the pc card. You are going to need certain hardware information to put the card in monitor mode and access its stats. Not all chipset makers will give this information. That is why programs like netstumbler only work 100% with hermes chip set cards. You are going to need a drivers design guide or a firmware programmers guide for the certain chipset you are using or your sniffer will not have accurate information aquired from the chip set and your sniffer will not be 100% accurate. In simple terms your sniffer program will need to communicate with the chipset in order to get proper feedback on what it is monitoring.

[jsndgl]

I am looking to do something simular, but am completely new to programming for specific hardware. Infact we have not chosen the final hardware yet. I'm looking to write or find some API or wrapper to a wireless card and be able to adjust the code easily if we change hardware design. Any suggestions on getting started. Do you contact the wifi card vendor for what I need? I really have no clue where to start. Does windows provide some API that I can hook into or do I need to talk directly to the hardware drivers. I will have to do this on WinXp and WinCE 5.0. Basically I will need to do the following:

Specify the SSID to connect to.
query the signal strength
scan for a certain IP address on the network
query the rf usage
detect all WAPs
and more that I can't think of off the top of my head?

Can someone also explain to me what NDIS is and can I acomplish what I need through this API on both XP and CE?

[M/Q]

I guess I will try again. Did you check ou the links I submitted in my previous posts? One goes as far to even show you a program. I am not sure what else you want.

As for NDIS, this link is to the developers website. I hate to say this but Google is a friend not an enemy.

http://www.ndis.com/

[jsndgl]

Yes I looked at the links. The program is written in Perl and is not what I'm looking for. I will be writting my applications in either C++ or .Net.

I've used google to research NDIS. This is how I know anything about it. It sounds like something I can use, but I'm having trouble putting all the peices together. The person who posted before me sounds like he knows a lot about this stuff and would really be able to help me. Basically what I'm looking for is a way to wrap an API to monitor and configure a wireless network, but I don't know how it all works. If I want to copy a file to a USB device I would use windows APIs to do so. How do I comunicate with a WiFi network card? Is there a standard way (perhaps a windows API) or is it hardware specific? What interface do card vendors provide if any? How does NDIS fit into all of this? It seems NDIS is the api used to write drivers but can I use it to talk directly to the hardware? If so how do I do it? I can not find a good example on Microsofts website?

[suzuki]

For packet capture, you can either use WinPcap (http://www.winpcap.org/) or roll out your own NDIS protocol driver on which you can do ReadFile/WriteFile.

If you want to write a program that can capture packets from all networks without association (monitor mode), then you need some co-operation from the NDIS miniport drivers. In this case, you'll have to speak to someone from the company that designed the chipset you are working with.

To configure the device -- that is, associate, disassociate and scan for networks -- you need to deal with NDIS OIDs (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/NetXP_r/hh/NetXP_r/217wirelessoid_bca9862e-feea-406f-b11d-ea01859bfbd3.xml.asp)
You can query/set most of the useful NDIS OIDs using WMI.

Regards,
Divya

Plug: I've written a connection manager with rudimentary site survey features (http://wifihopper.com). :D

[jsndgl]

At on point I planned on using WMI, but found that it is not avaliable on the WinCE Kernel :(

Is there any other way (that is supported by CE) to query/set the information normally exposed by WMI.

[suzuki]

At on point I planned on using WMI, but found that it is not avaliable on the WinCE Kernel :(

Is there any other way (that is supported by CE) to query/set the information normally exposed by WMI.

I'm not too experienced with programming under CE. But search for the following and it will take you in the right direction: "ndisuio windows ce"