Hack 20 Find All Available Wireless Networks

Locate all wireless networks in range without installing any additional software.

So, you've got a laptop. You've got a wireless card. The card might even be built into your laptop. You know there are wireless networks in your area. How do you find them? You might even have an external antenna connected to your wireless card, hoping to establish a longer distance connection. How do you find that network a half-mile away?

If you are connected to a wireless network already, you could download a tool like NetStumbler [Hack #21], but this requires a network connection and you don't have one yet.

All of the major operating systems have integrated software that allows you to discover wireless networks and obtain some status information about the currently connected network.

Windows XP

If a wireless access point is in range of your wireless card, Windows XP by default will attempt to automatically connect to the access point. It will inform you using a pop up above the task bar, which says, "One or more wireless connections are available."

Clicking on the network icon opens a window titled "Wireless Network Connection," as shown in Figure 3-1.

Figure 3-1. Available networks under Windows XP.

This window lists any wireless networks that are in range of your wireless card. In this example, there are three within range. The window also shows you that the selected wireless network requires the use of a WEP key [Hack #86] in order to join the network.

In order to join this network, you would need to type in the WEP key and then confirm the key by retyping. Once done, you would click on Connect. The window will close, and the network icon in the task bar should say "Wireless Network Connection (network name)". The icon also displays the wireless network speed and signal strength.

As shown in Figure 3-1, if you have difficulty connecting to any of the listed networks, you can click on the Advanced button, which opens a Wireless Networks window (Figure 3-2).

Figure 3-2. Advanced wireless network options.

This window again shows the available wireless networks. It also shows a list of "preferred networks" that can be added by the user. This is important to know if your wireless access point does not broadcast the SSID, saving you from repeatedly having to type in the name of the otherwise-invisible network and, indeed, needing to remember its name in the first place. Many access points have the ability to disable SSID broadcast as a security feature (so-called "closed" networks). This means that you need to know the SSID so you can add a preferred network (assuming, of course, that you aren't using a passive monitor like Kismet [Hack #31] or KisMac [Hack #24]).

At the top of this window is the checkbox: Use Windows to configure my wireless network settings. If this box is checked, Windows will automatically attempt to connect to any wireless networks listed in your preferred networks. If no preferred networks are available, it will provide you with a list of available wireless networks as shown above.

To get status on the wireless network to which you are currently connected, right-click on the network icon in the task bar and select Status. A typical status screen is shown in Figure 3-3.

Figure 3-3. Status details about the connected network.

While this gives you some basic connection information, it doesn't show you actual signal strength in dB, which would be very useful for testing wireless connections. You also do not get any information on signal-to-noise ratio. Clicking on the Support tab gives you IP addressing information for this wireless card.

Mac OS X

For Apple notebooks with a built-in AirPort card, all wireless configuration is handled through the System Preferences (System Preferences Network), as shown in Figure 3-4.

You will likely have two available network cards. Click the Show pull-down menu for a choice of adapters, including Built-in Ethernet and AirPort. Select AirPort. To get to the wireless network settings, select the AirPort tab.

Figure 3-4. AirPort configuration.

I'll come back to some of this later. Right now, you should be mostly concerned with the Show AirPort status in menu bar setting, which should be checked. Once you check this box and close the configuration window, you'll see a new icon in the menu bar (Figure 3-5). The first thing you'll want to do is click the menu bar icon and select the option to turn on the AirPort card.

Figure 3-5. AirPort configuration.

Once the AirPort card is on, you'll be able to see a list of available networks; you can select any of these. If a password (WEP key) is required for the selected network, you'll be prompted for it.

To connect to a network that is not listed, click on Other.... You will be presented with the Closed Network box, as shown in Figure 3-6.

Figure 3-6. Specifying the ESSID for a "closed" network.

Here you can enter the network name (SSID) of the wireless network you want to join and the password (WEP key), if one is required. This is how you can join networks that do not broadcast their SSID.

Once you've either selected an available network or entered information for another network not listed, you'll see which network is currently connected by using the AirPort menu bar (Figure 3-7).

Figure 3-7. You can quickly tell which network you are on, and easily choose between all available networks.

The AirPort software offers a signal strength meter, though it is rather limited in its granularity. Click the AirPort icon in the menu bar and select Internet Connect; you'll see a window similar to that shown in Figure 3-8.

Figure 3-8. Apple's simple status screen leaves much to the imagination.

Combined with the lack of a connector for external antennas, this severely limits the AirPort wireless card as a useful tool for testing wireless network connections. For more advanced diagnostics, you might want to take a look at MacStumbler [Hack #22].

Linux

Using wireless networking cards in Linux can require a good deal of work, depending on your particular Linux distribution. We're not going to cover that here. This assumes you have PCMCIA support for your wireless card, the Wireless Extensions in your kernel, and the Wireless Tools package installed. Both the Wireless Tools and kernel patches for the Wireless Extension can be found at http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html. The v.14 Wireless Extensions are included in the 2.4.20 kernel, and v.16 are included in the 2.4.21 kernel.

The Wireless Tools package does come with many distributions. It provides four command-line tools:

iwconfig

Allows you to manipulate the basic wireless parameters

iwlist

Allows you to list addresses, frequencies, bit-rates, and more

iwspy

Allows you to get per node link quality

iwpriv

Allows you to manipulate the Wireless Extensions specific to a driver

iwlist is the tool you need at the command line to show you available wireless networks. To enable scanning, use this:

# iwlist wlan0 scanning

This gives you detailed information about all detected networks and is supported in the newer versions of the Wireless Extensions/Tools. You'll see output similar to the following:

wlan0   Scan completed :      Cell 01 - Address: 00:02:6F:01:76:31           ESSID:"NoCat "           Mode:Master           Frequency:2.462GHz           Quality:0/92 Signal level:-50 dBm Noise level:-100 dBm           Encryption key:off           Bit Rate:1Mb/s           Bit Rate:2Mb/s           Bit Rate:5.5Mb/s           Bit Rate:11Mb/s

If there are multiple access points visible from your machine, you receive detailed information on each one. Once you've found the access point you need to connect to, you can use iwconfig to tell your card about it.

Anyone who works with wireless networks in Linux will likely be looking for a more powerful link state monitoring tool. Be sure to take a look at Wavemon [Hack #33] if you need more functionality than the simple command-line tools provide.

Roger Weeks