Packet Injection

Gone West

Im having a small problem whilst trying to break the encryption on one of my wireless lans. I tried to inject packets into it to induce more traffic, and hence capture more weakend type IV packets, which when enough are gathered can be used to solve my WEP key.

Leaving my packet logger running overnight was enough to gather about 1million of these packets without any form of packet injection. However, If I could inject packets, this time could be decreased to about half an hour.
However, to properly send in these packets, I need to know the MAC address of both the AP and a client connected to this AP. Getting the MAC of the Ap is no problem, using Kismet or equivalent.


My question, is how can I discover the MAC address of a remote client connected to a remote AP which I am not authed/dont have WEP key for.
Of course, I could simply check the MAC physically on the NIC, but that would be cheating!

Again, I am not trying this to crack someone elses network. In fact, as I've said, I've allready cracked the WEP after about 10 hours of packet logging. I am simply trying to see for myself firsthand how easy it is for someone to crack the WEP in less than half an hour.

Now, I cannot migrate to WMA, due to hardware restrictions so thats out of the question.

nutzboutstuff

Can you use Ethereal to sniff the packets being sent from the AP to the client, i've done this on my mac without problem before, you can see the host ip address and the mac address, as well as the AP traffic. Although ethereal is just a fancy packet sniffer... Although i dunno about a network you don't have access for...

Capt'n Midnight

Would have thought that Kismet would show you the MAC of the remote station in the same way it shows the AP. Or can you only see the AP directly ?

nutzboutstuff

Well i've always had a problem with Kismac not showing me the clients, but ethereal shows the destination address on the packets, and most of the time i can see the transmitted packets from the client as well...

Gone West

Kismet is great,but it only shows AP info. (MAC, IP, etc)
But ethereal wont work, AFAIK on networks which the user is not authenticated on.
I *could* auth myself and then sniff with ethereal, but that would be cheating

So my verdict, I suppose is that anyone with half decent knowledge of wireless nets and linux can hack most WEP given, say 12 hours.
But it seems very difficult(although not impossible) to do it within half an hour.

JoyPad

Kismet will give you the MAC of all associated NICs.
Select the AP with arrow keys, then press shift-C to bring up the list of clients.

HTH,
JP