background image

Airscanner Mobile Sniffer™ is a necessary component to any administrator’s toolkit. 

Included in this program are several useful functions and features that make it easy to use 
and user-friendly. Filtering, packet details, and a statistical breakdown all help you 
manage and monitor your WLAN traffic effectively and efficiently. In addition to a 
useful analysis of data on the Pocket PC, Airscanner Mobile Sniffer™, saves data in 
libpcap/Ethereal format, which allows further analysis of a capture session from your 
desktop. This can allow you to rebuild web pages, emails, and perform in depth analysis 
of all data captured. 

  

6.FAQs 

  

What can I do with the data I collect? 

  
Mobile Sniffer is a great first level tool. It can provide instant access to important 

data; however, it is not a full-fledged analyzer. We recommended you try Ethereal for a 
deeper analysis, which is why our saved files are in this format. Ethereal is free and 
available at www.ethereal.com.  It works wonderfully with Airscanner Mobile Sniffer 
packet session captures. 

  

I just saw my user name and password in a sniff session! Is this 

normal? 

  
YES! This is why any wireless network MUST be encrypted. Email, instant 

messages, web pages, and other tidbits of data are easily captured and read by a network. 
If you can see your personal information on your WLAN, so can anyone else. 

  

Can anyone tell that I am sniffing? 

  
There are tools available online that can help a person deduce that a sniffer is in 

operation. However, due to the fact that wireless is broadcasted, a passive sniffer can 
usually capture everything without being detected. 

  

Winpcap is Copyright (c) 1999-2003 NetGroup, Politecnico di Torino. All rights reserved. 

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following 
conditions are met: 

 

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.   

 

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following 
disclaimer in the documentation and/or other materials provided with the distribution.   

Neither the name of the 

"Politecnico di Torino"

 nor the names of its contributors may be used to endorse or promote 

products derived from this software without specific prior written permission.  

Summary of Contents for Mobile Sniffer

Page 1: ...Airscanner Mobile Sniffer For Windows Mobile Pocket PC Technical Whitepaper and User s Guide Level ___ Beginner _x_ Intermediate _x_ Advanced ___ Expert Estimated Reading Time 60 minutes...

Page 2: ...r TM Mobile Sniffer packs the power of a full scale sniffer into an application for portable devices Once your Windows Mobile device is linked to the network Airscanner TM Mobile Sniffer monitors all...

Page 3: ...006 Airscanner Corp Please ask permission before redistributing this software or user s manual Version History Version 1 0 released April 30 2003 Version 1 02 released May 7 2003 Version 2 0 released...

Page 4: ...ace or as part of a complex and very expensive hardware device e g 40 000 GTX Multi protocol analyzer that can handle multiple network lines and GBs of data Though it is just a tool it like many other...

Page 5: ...his is because there are several major types of wireless network cards WNICs available on the market Fortunately these have become more standardized across OEMs especially now that built in WiFi cards...

Page 6: ...etwork to see if any of the data is labeled with its MAC address If there is a match the data is passed up to the next layer in the protocol stack and ultimately to the program to which it was sent Ho...

Page 7: ...access to it 2 3 ARP Spoofing As we have previously discussed the existence of a switch in a network is a serious obstacle to a sniffer Due to a MAC IP table traffic from one NIC will only be passed...

Page 8: ...f the technical aspects of the filtering language most filters are very similar in appearance and are easy to understand The following represents two filters one from Ethereal which is the most common...

Page 9: ...is time to take a look at how you can benefit from Airscanner Mobile Sniffer In addition we have included a section on Ethereal to help you prepare for future analysis of collected data from Airscann...

Page 10: ...orrectly Symptoms of a problem include obvious error messages program crashes or the lack of promiscuous mode during an otherwise normal sniffing session 3 1 3 Installation Assuming you have met all t...

Page 11: ...outline the usage features of Airscanner Mobile Sniffer It assumes you have Airscanner Mobile Sniffer installed and working properly To use Airscanner Mobile Sniffer locate the MobileSniffer icon in...

Page 12: ...apters are usually not easy to understand 3 1 5 Menus Airscanner Mobile Sniffer is laid out in a functional and logical format There are two menu options on the menu bar at the bottom of the pocket PC...

Page 13: ...o review This option was included to let you make the decision if you wanted the old data erased or not It is set by default to clear the screen at the start of each capture session Promiscuous Mode A...

Page 14: ...is is set at a default of 100 packets This is a conservative setting but we prefer to allow you to increase this setting to a higher value as your Pocket PC device permits If it is too high you could...

Page 15: ...e Sniffer This option is covered in detail in the filtering section Enable Filter By default filtering is not enabled when sniffing However if you want to narrow down the collected data to an exclusiv...

Page 16: ...ets the capture files View Packet Details While knowing the IP address and MAC address of each packet is useful the real power of sniffing is knowing what is inside the packet This option gives you th...

Page 17: ...to define where on the pocket pc you want to save the capture file Like the Save Packets to option this will help you control where to store data to avoid overflowing the pocket pc s device Start Sto...

Page 18: ...This can help you narrow down traffic to a particular service Port Number The port number is important because it often indicates the reason for the traffic For example port 80 is the default port use...

Page 19: ...2 2 Installation on Windows Installation varies depending on the platform Because 98 of people using this program employ either a Linux distribution such as RedHat or a Windows operating system we wil...

Page 20: ...d files Text2Pcap Tool for converting raw ASCII hex to libpcap format packet capture files Mergecap Tool for merging several capture files into one file 6 6 Finish installation 3 2 2 4 Running Etherea...

Page 21: ...e data in the packet Packet Detail This window contains more detailed information about the packet such as MAC addresses IP address packet header information packet size packet type and more This is f...

Page 22: ...card must be able to receive and transmit data If the card does not work properly before using Ethereal it will certainly not work while it is running In addition if you are using a WNIC you might be...

Page 23: ...he ring buffer to create numerous files in case you collect the maximum number of packets required to fill up the first file it allows you to capture infinite amounts of data You can also adjust name...

Page 24: ...e Ethereal window In this example we will create a filter for AIM and Quake Quake is a multiplayer game whose mastery is an essential prerequisite for any competent security professional However if yo...

Page 25: ...ntences we stop the capture and let Ethereal load the data into the packet display windows At this point we have a great deal of commingled data How can we sort through this data to find our chat sess...

Page 26: ...g 4 Troubleshooting If you experience problems with Airscanner Mobile Sniffer please review the following symptoms to help guide your trouble shooting efforts Unable to set mode This error is given wh...

Page 27: ...in a sniff session Is this normal YES This is why any wireless network MUST be encrypted Email instant messages web pages and other tidbits of data are easily captured and read by a network If you can...

Page 28: ...IDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON A...

Reviews: