AirSnort

AirSnort is a handy wireless LAN (WLAN) tool that helps you recover encryption keys. It works by quietly monitoring data transmissions and can figure out the encryption key once it has gathered enough packets.

Understanding WEP Security Flaws

The 802.11b standard, which uses the Wired Equivalent Protocol (WEP), has a lot of security issues. One major problem is highlighted in the paper "Weaknesses in the Key Scheduling Algorithm of RC4" by Scott Fluhrer, Itsik Mantin, and Adi Shamir.

Who Created AirSnort?

Adam Stubblefield was the first to put this attack into action, but he didn't release his software to the public. Luckily, AirSnort, along with another tool called WEPCrack, was made available around the same time.

How Does AirSnort Work?

AirSnort needs to gather about 5-10 million encrypted packets. Once it has enough data, it can guess the encryption password in less than a second!

Requirements for Using AirSnort

You can run AirSnort on either Windows or Linux. Just make sure your wireless network interface card (NIC) can do RF monitor mode and pass monitor mode packets through the PF_PACKET interface. Here are some cards that work well:

• Cisco Aironet


• Prism2 cards using wlan-ng or Host-AP drivers


• Orinoco cards and clones with patched orinoco_cs drivers


• The latest Orinoco drivers >= 0.15 with built-in monitor mode support


• And many others!


• If you're on Windows: Any card supported by Airopeek.

If you're using Linux, check out Kismet's site for help finding out if your card supports monitor mode and what drivers you'll need.

How to Compile AirSnort

If you want to compile AirSnort, here's what you need to do:

1. Make sure your drivers are set up correctly! You might need:
   
   
   
   • The kernel source.
   
   
   • A PCMCIA CS package.
   
   
   • wlan-ng package.
   
   
   • Patches for Orinoco drivers.
   
   
   • Host AP drivers.
   
   
   
   

You also need to install the LATEST version of libpcap and make sure any old versions are removed (this isn't required for Windows users).

Your system should have gtk+-2.2 installed since AirSnort uses a GUI application. You'll also need gtk+-devel.

If You're Using Linux:

1. # tar -xzf airsnort-0.2.6.tar.gz



2. # cd airsnort-0.2.6



3. # ./configure



4. # make



5. # make install (optional)

This will get you set