Wireless LAN Detection with NetStumbler
NetStumbler is a powerful wireless network detection tool available free that can be used to install or troubleshoot a wireless network. When setting up, configuring or troubleshooting a wireless network, knowing detailed technical information such as possible conflicting channels and service set identifiers (SSIDs), can help you complete the job properly and more securely. NetStumbler uses 802.11 a,b,g networking standards, it is compatible with most wireless LAN adapters and runs on Windows 2000, Windows XP or better. Possible applications for NetStumbler include WLAN auditing, WLAN coverage verification, wardriving, antenna positioning and site surveying.
Antenna Positioning - When installing an antenna use NetStumbler to assist you in positioning and aiming the antenna to get the best coverage possible.
Site Survey - When installing or troubleshooting a wireless LAN, it is important to pick locations and channels in such a way that interference is minimized. A site survey typically includes finding out what existing items (microwave ovens, cordless phones, radio hams) are using the radio frequencies as the wireless LAN. A survey should done before installation of a new wireless LAN, and then subsequent surveys should be performed after installation. A full site survey requires special hardware such as an RF spectrum analyzer, but NetStumbler can also be used as part of a site survey.
Wardriving - Detect wireless LANs while moving, walking or in a vehicle, using a laptop or PDA (use of a GPS receiver is highly recommended).
Wireless Coverage Verification - Use NetStumbler to verify signal quality as well as extended coverage beyond the intended area.
Wireless LAN Auditing - Securing a wireless LAN from unauthorized or “rogue” access points setup independently by network users is a task common to network administrators. Using a laptop and walking around the office, an audit can be performed using NetStumbler to detect the presence of a risky exposure to the wireless LAN.
NetStumbler’s List View
The list view contains an item for each BSSID detected. A large amount of information is presented in the columns.
| Column | Description |
| MAC | The text contains the BSSID for wireless devices. The icon shows the signal strength as reported in the last scan: Gray means the item was not detected, or a colored icon ranging from red to green reports the signal strength. A lock appears in the icon if encryption is enabled on the network. For devices on a wired network segment, the icon shows a T-shaped network cable and the MAC address is displayed. |
| SSID | The reported SSID. This may be blank for access points that report their existence but not their SSID. For wired network items, the SSID is assumed to be the SSID that was associated when the item was discovered. |
| Name | The device’s name. This is reported rarely and only if “Query APs for names” is configured. |
| Chan | All the channels that the device has been seen on. The most recent one is listed first. Before the channel number may be a star (*), which means you are associated with the device, or a plus (+) which means that you were associated with it at some point. |
| Speed | The maximum reported bandwidth for the device (this is not the actual bandwidth). If you are using an 802.11b device, it may misreport the bandwidth of 802.11g networks as 11Mbps. Some devices are capable of 108Mbps but only report 54Mbps. |
| Vendor | The vendor assigned to the MAC, which may not be the actual equipment manufacturer. |
| Type | “AP” for a BSS, “Peer” for an IBSS. |
| Encryption | The word “WEP” will appear on an encrypted network, regardless of whether it is really using WEP. |
| SNR | The current Signal to Noise ratio, either in dB or arbitrary RSSI units. |
| Signal+ | The highest seen Signal value. |
| Noise- | The lowest seen Noise value. |
| SNR+ | The highest seen SNR value. |
| IP, Subnet | The IP configuration of the object, if available. |
| Latitude, Longitude, Distance | If you are using a GPS receiver, this indicates the estimated position of the object. This position is currently the location where the strongest signal was seen, which is never the actual location. Distance is measured from your current position to the object’s estimated position. |
| First Seen | The time or date when the object was first discovered. |
| Last Seen | The most recent time or date when the object was seen. |
| Signal | The current Signal level, either in dB or arbitrary RSSI units. |
| Noise | The current Noise level, in dB. Not supported by all devices. |
| Flags | The 802.11 capability flags, in hexadecimal. |
| Beacon | The 802.11 beacon interval, in Kµs. |
NetStumbler Video - Watch this video by SecurityTube to learn more about how NetStumbler works.