How can I log intruders?

2 Mar 2005 2:45 PM

Interceptor

Is there an (easy) way to log all the wireless machines that have been or
tried to connect to my Lynksys WRT54G?
I use WEP but there are about 8 networks within easy reach of my house, so
I know there are lot of wireless PC's or laptops around.
And perhaps there is a enthousiast around with Airsnort or Airopeek
software analyzing the data packages etc etc.
Or am I being to paranoid, ;-)

Thanks for any Help.

2 Mar 2005 6:21 PM

Jeff Liebermann

On Wed, 02 Mar 2005 15:45:55 +0100, Interceptor <nomail@nomail> wrote:

>Is there an (easy) way to log all the wireless machines that have been or
>tried to connect to my Lynksys WRT54G?
>I use WEP but there are about 8 networks within easy reach of my house, so
>I know there are lot of wireless PC's or laptops around.
>And perhaps there is a enthousiast around with Airsnort or Airopeek
>software analyzing the data packages etc etc.
>Or am I being to paranoid, ;-)

Paranoia is often a good thing.

For Linux, I use Snort for intrustion detection:
http://www.snort.org

For Windoze, I found these which admittedly, I haven't had time to
try:
Airsnare
http://home.comcast.net/~jay.deboer/airsnare/
Wallwatcher
http://www.sonic.net/wallwatcher/

For analysis of what they are doing after breaking in, I prefer
Ethereal:
http://www.ethereal.com
for both Linux and Windoze.

--
Jeff Liebermann    je***@comix.santa-cruz.ca.us
150 Felker St #D   http://www.LearnByDestroying.com
Santa Cruz CA 95060    AE6KS 831-336-2558

2 Mar 2005 7:29 PM

Airhead

"Interceptor" <nomail@nomail> wrote in message
news:Xns960DA0567D69Fnomail@213.73.255.55...
> Is there an (easy) way to log all the wireless machines that have
been or
> tried to connect to my Lynksys WRT54G?
> I use WEP but there are about 8 networks within easy reach of my
house, so
> I know there are lot of wireless PC's or laptops around.
> And perhaps there is a enthousiast around with Airsnort or Airopeek
> software analyzing the data packages etc etc.

> Or am I being to paranoid, ;-)

Probably, but their is a free little tool called airsnare that will
alert you if anyone actually connects
to your network which would be useful if they cracked your wep key,
but finding out if someone
is just passively sniffin the network is probably not possible.