• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 7792
  • Last Modified:

Wireless network - where is it, what is it, etc?


A wireless network recently showed up at our office.  We own the entire building, so there shouldn't be one (we don't permit wireless networks).

I noticed it while booting my XP laptop, it has a wireless G card in it, and it found a network.  It is WEP protected though, so I couldn't connect.

Anything I can do to find out anything about it?  What kind of device is the access point, what network it is passing out (IP addresses), direction of the signal, etc?

Prefer XP tools but I can use linux if I have to.

  • 5
  • 3
  • 3
  • +3
1 Solution
Well network stumbler is a good start:


What is NetStumbler?
NetStumbler is a tool for Windows that allows you to detect Wireless
Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g.
It has many uses:
• Verify that your network is set up the way you intended.
• Find locations with poor coverage in your WLAN.
• Detect other networks that may be causing interference on
your network.
• Detect unauthorized "rogue" access points in your workplace.
• Help aim directional antennas for long-


Grab a notbook an take a walk, I would say ;-)


Are you sure it is in your building?  Perhaps it is in an adjoining building?
Your Wireless G card has a range of perhaps 200 feet in the open.

Since you don't state which brand card you have, you may well not be able to use NetStumbler. (Orrinoco)

For a variety of programs many of which work with other wireless cards, go to:

Note: that most of the programs require Linux, though there are a few there for Windows.
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

I can imagine that a colleague has a new laptop with a WLAN pcmcia card or it's even buildin, using it @ home.

So it is no intentional AP. But talking a look around with network stumbler is no bad idea.


It's not just orinoco (lucent technologies)

Check http://www.stumbler.net/compat/ as reference:

Cards that have been reported to work

The following table contains the cards most commonly reported as working properly on NetStumbler 0.4 on Windows XP. They are listed in order of the number of unique reports received, with the most "popular" cards towards the top. Note that this does not make them the best cards for you to use; it just means that lots of users sent in reports for them. The "Win2K" column indicates if any reports were for Windows 2000. Since this accounts for around 10% of reports, a "No" in that column does not necessarily mean that it won't work, just that nobody sent a report for it. The author has not tested all of these cards personally.

Manufacturer      Model      Win2K
D-Link      AirPlus XtremeG DWL-G650 Wireless Cardbus Adapter      Yes
D-Link      AirPlus DWL-520 Wireless PCI Adapter      Yes
D-Link      AirPlus DWL-650 Wireless Cardbus Adapter      Yes
Linksys      Wireless-G Notebook Adapter      Yes
Proxim      ORiNOCO "Classic" Wireless LAN PC Card      Yes
Cisco      350 Series: AIR-PCM352 (PC Card), AIR-LMC352 (PC Card with dual MMCX), and possibly the AIR-PCI352 (desktop PCI) cards      Yes
Linksys      Instant Wireless PCI Card V2.7      Yes
(Various)      Realtek RTL8180 Wireless LAN (Mini-)PCI NIC      Yes
Intel      PRO/Wireless 2200BG Network Connection      Yes
D-Link      AirPlus DWL-120 Wireless USB Adapter      No
Dell      Wireless WLAN 1450 Dual Band WLAN Mini-PCI Card      Yes
Dell      TrueMobile 1300 WLAN Mini-PCI Card      Yes
D-Link      AirPlus DWL-G520 Wireless PCI Adapter(rev.B)      Yes
?      22M WLAN PCI Adapter      No
(Various)      Zydas ZD1201 IEEE 802.11b USB Adapter      Yes
?      22M WLAN Adapter      No
Linksys      Wireless-B Notebook Adapter      Yes
U.S. Robotics      802.11g Wireless Turbo Adapter      Yes
Netgear      WG511 54 Mbps Wireless PC Card      Yes
?      PCM1000 Wireless LAN Card Adapter      Yes
LAN-Express      IEEE 802.11 PCI Adapter      Yes
Toshiba      Wireless LAN Mini PCI Card      Yes
3Com      OfficeConnect Wireless 11g PC Card (3CRWE154G72)      Yes
Linksys      Wireless-G Notebook Adapter with SpeedBooster      Yes
Intel      PRO/Wireless LAN 2100 3B Mini PCI Adapter      Yes
Asus      802.11b Network Adapter      Yes
Netgear      MA401 Wireless PC Card      Yes
Linksys      Wireless-G PCI Adapter      Yes
D-Link      Air DWL-610 Wireless Cardbus Adapter      Yes
Asus      802.11g Network Adapter      Yes
Cisco      PCI Wireless LAN Adapter      Yes
?      WLAN miniUSB Adapter      Yes
Netgear      108 Mbps Wireless PC Card WG511T      Yes
Compaq      WLAN MultiPort W200      Yes
Atheros      AR5001X Wireless Network Adapter      Yes
Belkin      Wireless 54Mbps Desktop Adapter      Yes
Dell      Wireless 1350 WLAN Mini-PCI Card      Yes
Linksys      Instant Wireless - Network PC CARD      Yes
TI      ACX100 WLAN Adapter      No
Buffalo      WLI-CB-G54 Wireless LAN Adapter      Yes
Belkin      802.11g Network Adapter      Yes
D-Link      AirPlus G DWL-G120 Wireless USB Adapter      No
Intel      PRO/Wireless LAN 2100 3A Mini PCI Adapter      Yes
Microsoft      Broadband Networking Wireless Notebook Adapter      Yes
Enterasys      RoamAbout 802.11 DS      Yes
Z-Com      IEEE 802.11 Wireless LAN/PC Card(5V)      No
Dell      TrueMobile 1150 LAN Card      Yes
Linksys      Wireless-G USB Network Adapter      Yes
Z-Com      PRISM 802.11g Wireless Adapter (3890)      Yes
Senao      IEEE 802.11b WLAN network adaptor PC Card      Yes
D-Link      Air DWL-510 Wireless PCI Adapter      Yes
D-Link      AirPlus G DWL-G630 Wireless Cardbus Adapter      Yes
Dell      TrueMobile 1300 USB2.0 WLAN Card      No
HP      WLAN 54g W450 Network Adapter      No
Broadcom      802.11b/g WLAN      Yes
Linksys      Instant Wireless-B PCI Adapter      Yes
Netgear      WAG511 802.11a/b/g Dual Band Wireless PC Card      Yes

At http://winfingerprint.sourceforge.net/aptools.php, you will see a list of ranges of MAC addresses for wireless cards.  If you see any of these MACs on your network, you have a strong indication that you are being penetrated from a wireless device.

Another type of tool which can be useful, are dedicated handheld RF sniffers.  They can be quite cheap, and with directional abilities, can lead you towards the actual location of the hacker.
If you are able to use netstumbler, you can find out a good amount of info such as Brand name of AP, MAC address, and signal strenth.  If you happen to have a wireless card and a directional anntenna that would with netstumbler you could use it kind of like a giger counter to trace the signal in the building (AKA point anntena in a certin direction and see where the singal is strongest and start walking and find where the signal is strongest)

You need to do a few things.

Physical Survey. You need to walk around inside your building and outside the building and look for signs of a wireless access point. These could be anywhere so look everywhere.

You need to map the wireless range and whilst doing that, keep an eye on signal strength and power raitings, tools mentioned above can do that. By mapping out the leakage of the wireless lan it should hopefully allow you to at least point in the direction of the physical device at which point you can concentrate on physical survey.

On the network side, if this thing is plumbed into you corp it network, you'll need to survey all live IP addresses. Try to ensure they are all valid IP's. As mentioned above there are scanners that can discover such devices on your network, also, if you are struggling, make a note of MAC addresses. The AP will have one that should be significantly different from the rest, each vendor is aloocated a bunch so you can figure out what a device is from its mac.

chances are if you do a walkabout  and identify where the signals/power is strongest, you will quickly spot the AP device.
Back to you original questions:

> I noticed it while booting my XP laptop, it has a wireless G card in it, and it found a network.  It is WEP protected though, so I couldn't connect.
> Anything I can do to find out anything about it?  What kind of device is the access point, what network it is passing out (IP addresses), direction of
> the signal, etc?

With a tool like network stumbler you can find out where the signal is strongest, so you have to, as tmehmet suggests, take a walk, best with a copy of the plant layout and mark the strength of the signal, to pin point the origin.

All other details, like IP addresses, SSID, MAC addresses  are a bit more difficult to identify and are no problem as long as the AP is outside of the building. The most important thing is to locate it's source. Then you can ask questions: social hacking is driver independent ,-)

My money's on the neighbours having a WAN.
@ kneH, ok I'm in, so how much do you want to pay me for the letter "L" ;-)

A Wide Area Network is no security problem....most times...

LOL meant that.

Gimme yer paypal acct no ;)
well I meant WLAN actually.

And kinell someone put an edit button on this board!
shanepresleyAuthor Commented:
Thanks folks.  I've got a Linksys, and NetStumbler supports it, so so far so good.  

I'll visit the site on Monday, do a physical walk through, and try NetStumbler.  I'll post an update then.  


Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 5
  • 3
  • 3
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now