Wireless hub/managed switch

[hardya]

I am a real newbie to this:

I read this article and I want to snif packets in general but in poarticular MSN, not sure what the application protocol is like.

Basically I have a wireless lan so no cabling and the article mentioned a (non-wireless) hub or managed switch. Can I get such a thing as a wireless hub (or wireless managed switch, ie with port-mirroring)?

One thing I don't quite understand is since the devices on the network aren't actually plugged in as such, how is it ensured which is connected to which wireless port to get the sniffer to receive from the port that is mirorred out?

Hope this makes sense. I'm not really looking to spend a fortune its just an experiemnt at the moment.

Many thanks, any advice for this newbie greatly appreciated.

 

[jdabbs]

Your options are to sniff the airwaves directly (assuming you have a wireless card capable of promiscuous mode) or install a hub/managed switch upstream of the AP/router.

 

[hardya]

Yes, this is more or less what I thought, but what I was wondering was can I get a WIRELESS hub/managed switch and if so how are the devices matched to the ports?

If I cannot get a wireless hub / managed switch then surely if I want to monitor a few devices on my lan then they all need to be plugged in to the hub don't they? And to do that I need to turn my wireless lan into a cabled lan with all kinds of cabel running round my house, right?

Or have I got the complete wrong end of the stick?

 

[jdabbs]

The closest you can get an AP cabled to a managed switch/hub. Wireless devices don't map to ports (only the port the AP is connected to); if you don't sniff the airwaves you can only monitor traffic flowing to/from the AP, which is why I also recommended an upstream device.

If you want to monitor non-local traffic (like the aforementioned MSN sessions) add an upstream device. Wireless, wired--doesn't matter, if data passes through the hub/managed switch on the way to the Internet, it can be sniffed.

 

[hardya]

Also I don't quite understand why you would need promiscuous mode OR hub and not both. When the hub rebroadcasts incoming packets on all its other ports, does that mean those packets go out (still with the original ip addresses at the ip layer I guess) with a new mac addresses at the ethernet layer? I'm new to this and I hven't found an article yet that actually says this.

 

[jdabbs]

Read more closely. I stated you need a wireless card capable of promiscuous mode or a hub/managed switch. You still need a wired NIC to take advantage of the hub/managed switch route, but since most wired NICs support promiscuous mode you don't have to seek that capability out (which is why it didn't warrant a mention).