A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Search Irongeek.com:

Affiliates:
Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:

paypalpixle


Man page of SSIDSNIFF

SSIDSNIFF

Section: Maintenance Commands (8)
Index of this MAN page

Back To MAN Pages From BackTrack 5 R1 Master List  

NAME

ssidsniff - reconaissance of wireless access points  

SYNOPSIS



ssidsniff [-VdDgH] [-i interface] [-s snaplen]
[-f filter] [-c maxcount] [-w file] [-v level]
 

DESCRIPTION

ssidsniff is an application that identifies wireless networks. It supports any wireless card that is able to deliver raw 802.11 frames. ssidsniff then uses the 802.11 packet header from received wireless network frames from access points as well as networked hosts to display a sortable view of available wireless networks.

ssidsniff is an interactive application, with a curses(3) text interface resembling the Unix top utility. The screen is split between a top level multi line status area indicating items such as overall capture statistics, battery status, interface name and frequency. The remainder is normally used for displaying discovered wireless networks. Within the network display portion, the user can select a specific network entry for subsequent actions described further.

When capturing frames, a unique capture file name is automatically generated based on hostname and current date. The user can override this behavior.  

OPTIONS

-i interface
Set the network interface to use for capturing. The interface will be brought up and set in monitor mode automatically. If these operations fail, a warning will be given but the program will continue regardless. If no interface is specified, the capture library will select a default.
-s snaplen
When capturing, limit frame size to snaplen bytes.
-f filter
When capturing, use filter as the PCAP filtering expression. For documentation on filtering expressions, consult tcpdump(8).
-w savefile
Use savefile as the PCAP capture file, instead of automatically generating a unique file name.
-r file
Read saved packets from file in PCAP format, parse them and then enable the user interface. When this option is used, no packets will be captured from the network.
-v level
Set the debugging level. Messages are delivered to standard error and will need to be redirected for a usable display.
-V
Display the program name and version number, then exit.
-D
Save absolutely every frame received via the network interface to capture file.
-d
Save 802.11 data frames only to capture file.
-g
Send data from every frame received to an audio device, if available.
-H
Enable the channel hopper.
 

USAGE

Available commands are:

i
Display available information for currently selected network, such as channel, WEP capability, manufacturer and packet count statistics. Any subsequent key will return to network view mode.
j, k, down/up arrow key, Page down/up
Move network selector down or up; page up or down if there are more than a page full of networks.
d
Display ASCII strings in data packets. Useful to get a quick view of printable data within past frames. A circular buffer is used that is updated as frames are received.
o <key>
Sort order selection:
r: No sorting - display networks as they are discovered
s: Sort by SSID text name
c: Sort by channel
p: Sort by highest packet count (including beacon frames)
d: Sort by highest data count
n: Sort by highest packets per second figure
b: Sort by BSSID
S: Sort by received signal power
a: Sort by activity last seen
w
Start/stop saving data packets from currently selected network. A status flag of W indicates which network entries are selected for data collection. The data file name is created unique using the host name and a serial number amongst other components.
W
Start/stop saving data packets from all networks. A top right status indicator of Cap means that the capture file is open for writing, whereas Data indicates data frame only capture.
A
Start/stop saving all received frames. A top right status indicator of All means that this mode is active.
H
Start/stop the network channel hopper. When active, the network interface will automatically change channels according to a predetermined sequence so that the maximum amount of networks is discovered. When active, a top right status indicator of Hop is on.

Over time, the channel hopping algorithm determines busy channels and will progressively provide more time to them, so as to maximize the possibility of capturing interesting data. This bias is neutralized periodically to avoid unfairness.

f
Focus on a specific network. This command stops the channel hopper if it is currently on, and sets the channel to match the selected network. s Start/stop sending received frames to a sound device, if available.
c
Set the wireless interface channel.
r
Record all wireless networks seen to a text file. The data file name is created unique using the host name and a serial number amongst other components.
^L
Redraw screen.
h
Show a help page on available commands.
q
Quit the application. The network interface is restored to normal operation from monitor mode.

 

NETWORK FLAGS

Each network has a flag code associated with it.
A
The network includes an access point.
H
The network only includes hosts.
W
Packet capture is enabled for this network.
e
WEP Encryption is possible (but not necessarily used) on this network.
E
Encryption is in use for this network.
w
WPA or WPA2 is possible for this network.
x
Extended data rates (802.11g or better) advertised as available.
 

HARDWARE SUPPORT

Cisco PCM-340, PCM-350; Intel ipw2100; Lucent Orinoco; Intersil PRISM; Atheros  

BUGS

Rudimentary FreeBSD support implemented.
Signal strength support is rudimentary.
A little endian platform is currently assumed by the packet parser  

FILES

/proc/apm, /proc/net/wireless  

SEE ALSO

ifconfig(8), tcpdump(8), iwconfig(8), iwpriv(8), pcap(3)  

AUTHOR

kos@bastard.net


 

Index

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
USAGE
NETWORK FLAGS
HARDWARE SUPPORT
BUGS
FILES
SEE ALSO
AUTHOR

This document was created by man2html, using the manual pages.
Time: 07:34:21 GMT, September 13, 2011

Printable version of this article

15 most recent posts on Irongeek.com:


If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2016, IronGeek
Louisville / Kentuckiana Information Security Enthusiast