WIRELESS FOOTPRINTING

Wireless networks and access points (APs) are some of the easiest and cheapest types of targets to footprint (or "war-drive") and ironically some of the hardest to detect and investigate. War-driving once was synonymous with the simple configuration of a laptop, a wireless card, and Network Stumbler (or NetStumbler). Now it is a much more sophisticated setup that can utilize multiple types of high- powered antennas, wireless cards, and palm- sized computing devices, including the ever-popular iPAQ and Palm. Allegedly, this will also be possible with a new version of Microsoft's personal watches , which are supposed to be released in late 2005. Wouldn't that be something? Hacking a wireless network with your watch!

We use the term "war-driving" loosely in the realm of the hacking methodology and "footprinting" mainly because you do not have to be driving. You may walk around a technology park, downtown area, or simply through the halls of your own building with your laptop if you are performing an internal audit. Footprinting wireless devices, particularly APs, starts with the simple task of locating them via the passive method of listening for AP broadcast beacons or the more aggressive method of transmitting client beacons in search of AP responses. Understand that all WLAN footprinting can be done remotely as long as you are in range to transmit and receive beacons and packets to and from the AP. With this said, a huge advantage would be to have a better antenna than what usually comes with the card you purchase.

As you will see, the proper equipment makes all the difference in footprinting a WLAN. Numerous types of wireless cards exist, with different chipsets. Some allow you to put the card in promiscuous mode (that is, to sniff the traffic), and others will not. Likewise, certain cards inherently work better because they provide support for different operating systems. Antenna strength and direction are also equipment factors. You may want to use an omnidirectional antenna if you are just driving through crowded streets , or you can use a directional antenna if you're targeting a specific building, location, or AP. Oh yes, let's not forget about the global positioning system (GPS). GPS will prove to be a wonderful addition to your equipment list if you wish to track APs, monitor their transmitting range, and potentially retest them in the future.

Equipment

Certain types of equipment will be necessary to execute a subset of the presented attacks in addition to the required software. Wireless cards, antennas, and GPS devices, as you will notice, play a large role in what kinds of attacks can be executed and at what range these attacks will be successful.

Cards

Be aware that not all wireless cards are created equal. It is important to understand the requirements and limitations of the cards you plan to use. Some cards require more power, are less sensitive, and might not have an available antenna jack for expanding the range with an additional antenna. You should also know that the ramp-up times to use a card with particular operating systems are significantly different. If you choose to use Linux or BSD, you will have to recompile the kernels with the proper pcmcia-cs drivers, which may not be an easy task if you have little to no UNIX experience. Windows , on the other hand, is a much easier setup process, but you will notice there are far fewer tools, exploits, and techniques you can use from the Win32 console.

AiroPeek NX is the only wireless sniffer worth mentioning for the Windows environment. NetStumbler, a tool that often gets mistaken as a wireless sniffer, only parses wireless packet headers and uses a nice GUI for real-time reporting on access point location, identification, and a few other particulars. The AiroPeek NX application supports packet capturing via 802.11a and 802.11b, even though 802.11g is the current standard. It also supports non-U.S. channel surfing. The United States has provisioned for 802.11 wireless networks to utilize channels 1 through 11 for communication; however, other countries outside the U.S.commonly utilize channels 1 through 24. One particularly useful feature of AiroPeek NX, if you are an international traveler , is that it can support up to all 24 channels. The link listed here provides a full listing of the cards supported by the AiroPeek NX suite:

Windows WLAN Sniffer Driver Compatibility

http://www.wildpackets.com/support/hardware/airopeek_nx

The most widely supported OS in regard to wireless attack tools, drivers, and sniffers is by far Linux. The Linux community has invested significant time and resources developing a collection of PCMCIA drivers (pcmcia-cs) that are compatible with most vendor releases of the 802.11b Prism2 chipset. As stated earlier, you must compile these drivers into the kernel.

Installing the drivers is quite easy and extremely similar to just installing about all other Linux-based applications and drivers. The following installation instructions are current for version 3.2.8 of the pcmcia-cs drivers. Obviously, if a later version is out and you attempt to install it, make sure you change the version number in the file name and directory structures. You can download the current pcmcia-cs drivers from http:// sourceforge .net/project/showfiles.php?group_id=2405.

The following are general installation directions:

1. Untar and extract the pcmcia-cs-3.2.8.tar.gz files into /usr/src.

2. Run make config in /usr/src/pcmcia-cs-3.2.8.

3. Run make all from /usr/src/pcmcia-cs-3.2.8.

4. Run make install from /usr/src/pcmcia-cs-3.2.8.

Depending on your WLAN, system configuration, or target networks, you may need to customize the startup script and the option files in the /etc/pcmcia directory.

You can certainly find the drivers you need for your card with a quick query on http://www.Google.com, but it is always nice to have the information given to you. Therefore, listed next are some of the best locations to get your wireless card drivers for Linux. As you can see, they are divided by chipset:

Orinoco	http://airsnort.shmoo.com/orinocoinfo.html
Prism2	http://www.linux-wlan.com/linux-wlan
Cisco	http://airo-linux.sourceforge.net

Next, let's tackle the driver issue for all you who like the new OpenBSD kernel on the Mac laptops (or any other laptop you use that's loaded with OpenBSD). The OpenBSD kernel is very similar to Linux for the types of procedures required to get the system up and running in a wireless mode, specifically promiscuous wireless mode. Because of this, here's a good link where you can get drivers and more information on the BSD tools, if your heart so desires:

OpenBSD Wireless Drivers

http://www.dachb0den.com/projects/source-mods.htm

The 802.11g frequency is the latest protocol to hit the wireless mainstream. It has replaced the other 802.11 frequencies802.11a and 802.11beven though it is backward compatible. Therefore, you can use your 802.11b access point with your 802.11g card, and vice versa. This type of compatibility has become the wave of the future in regard to developing new types of technology.

Microsoft (http://www.microsoft.com) entered the wireless communication market in late 2002 but made a significant entrance in 2003 with their low-cost access point and wireless card bundles. For around $85, you could purchase an 802.11g AP and wireless card for Windows XP. Microsoft's new wireless NICs perform alongside with the Orinoco cards in comparison to range and packet loss.

Antennas

Be prepared. Finding and installing the proper antenna may prove to be the most cumbersome task in setting up your war-driving "giddyap." You must first decide what type of war-driving you are going to do. Is it going to be in a major city such as New York, Boston, or San Francisco? Maybe you are going to drive around an area that is less dense, such as the "Silicon Valley of the East Coast," Northern Virginia, or the suburbs of Los Angeles, where you need to drive at high speeds and may be 30 to 40 yards from the target buildings and their access points. These considerations must go into the decision for the antenna you are going to use (see Figure 8-1).

Figure 8-1: Typical war-driving antennas

To completely understand the differences in antennas, you need to get a little primer on some of the behind-the-scenes technology for the antennas. First and foremost, you need to understand antenna direction. Basically, there are three types of direction when it comes to classifying antennas: directional, multidirectional, and omnidirectional. In general, directional antennas are used when communicating or targeting specific areas and are not very effective for war-driving (if you are actually driving). Directional antennas are also the type of antennas that are most effective in long-range packet capturing because the power and waves are tightly focused in one direction. Multidirectional antennas are similar to directional antennas in the sense that both use highly concentrated and focused antennas for their transceivers. In most cases, multidirectional antennas are bidirectional (a front and back configuration) or quad-directional. Their range is usually a bit smaller when compared to equally powered unidirectional antennas because the power must be used in more than one direction. Lastly, omnidirectional antennas are what most think of when they think of antennas. An omnidirectional antenna is the most effective in close city driving because it transmits and receives signals from all directions, thereby providing the largest angular range. As an example, car antennas are omnidirectional.

Now that you understand the different terms for antenna direction, it is pertinent that you understand a few of the common types of antennas and how to distinguish a good antenna from a bad one. The wireless term "gain" is used to describe the energy of a directionally focused antenna. Realize that all transceiver antennas have gain in at least two directionsthe direction they are sending information and the direction they are receiving it. If your goal is to communicate over long distances, you will want a narrowfocus, high-gain antenna. Yet, if you do not require a long link, you may want a wide-focus, low-gain antenna (omni).

Very few antennas are completely unidirectional because in most cases this would involve a stationary device communicating with another stationary device. One common type of unidirectional antenna would be a building-to-building wireless bridge. A yagi antenna uses a combination of small horizontal antennas to extend its focus. A patch or panel antenna has a large focus that is directly relational to the size of the panel. It appears to be a flat surface and focuses its gain in one general direction. A dish is another type of antenna that can be used, but it's only good for devices that need to transmit in one general direction, because the back of the dish is not ideal for transmitting or receiving signals. For all practical purposes, you will most likely need an omnidirectional antenna with a wide focus and small gain that can easily connect to your wireless card without the need of an additional power supply.

Numerous vendors and distributors are out there that you could use to get the proper equipment to go war-driving. Listed next are some of our favorites. Each will sell you some of the general stuff you will need; however, Wireless Central is well known for its actual "war-driving bundles," and HyperLinkTech is known for its high-powered and long-range antennas.

HyperLinkTech	http://www.hyperlinktech.com
Wireless Central	http://www.wirelesscentral.net
Fleeman, Anderson, and Bird Corporation	http://www.fab-corp.com

Wireless networking and wireless Internet service providers (WISPs) are now popping up more than ever. Vendors such as Baltimore Wireless, Chicago Waves, and the seemingly unlimited number of mom-and-pop coffee shops in Seattle, Chicago, and New York offer free wireless Internet data services. These services were designed and created on the backs of strong antennas (some with amplifiers ), the 802.11g protocol, and custom MAC address filtering logic. We'd hate to call these antennas commercial-ready because none of them are the types you would find on a radar tower in the middle of trees; moreover, they are better classified as "super" home- user antennas.

These home-user antennas usually combine multiple directional antennas (at least four) or stack omnidirectional antennas to improve signal strength (see Figure 8-2). This type of configuration is ideal for anyone offering wireless services to multiple people, or buildings for that matter.

Figure 8-2: Quad stacked antenna

The quad antenna shown in Figure 8-2 is nothing more than four daisy-chained omnidirectional antennas acting as one. This type of service-based antenna will yield a half-mile radius if placed at a high location and could run as much as $1200 to $1500.

The Wireless ISP (WISP) antenna, shown in Figure 8-3, is a custom product offered out by WiFi-Plus. WiFi-Plus designs and creates custom high-end antennas, specializing in configurations for small wireless service providing. Do not expect to start the next Verizon Wireless with one of these; however, it is plenty strong to host a session with a dozen of your closest friends or neighbors. The WISPer or an equivalent antenna can run you between $2000 and $5000, or upwards of $10,000 with the purchase of a corresponding transmission amplifier .

Figure 8-3: WISPer antenna

WiFi-Plus antennas and products can be found at http://www.wifi-plus.com.

GPS

A global positioning system (GPS) is the wireless equivalent of using a network-mapping tool or application on wired network assessments (see Figure 8-4). Most GPS devices wrap into the war-driving software via timestamp comparisons. The GPS software keeps a real-time log of the device's position by mapping the longitude and latitude coordinates with corresponding timestamps into a simple text file. These text files are easily imported into a variety of mapping software programs that you can use to create colorful and accurate maps for identified access points and their range.

Figure 8-4: GPS unit

GPS units are relatively easy to purchase and install on your laptop, especially if you are a Windows user. Numerous vendors are available, and most of the actual devices are relatively similar when it comes to their technology aspects. The main differences between the competing products involve aestheticsthe look and feel of the unitsand the software that comes packaged with the products. Good software comes with a good amount of rural and suburban maps, up-to-date streets, and most important, an excellent direction algorithm. These features all come into use when you attempt to route future war- drives to ensure you don't backtrack as well as when you are profiling large areas.

Installing the drivers and the GPS unit is more or less straightforward; however, there are a few considerations you should make before the actual installation takes place. You will need to determine where your setup will go and how you will actually do your war-driving. For example, a serial cable is needed for connecting your GPS to your laptop in most cases, plus you will find out that your GPS unit gets better and more accurate location readings if it has direct access to the sky. Those of you who are fortunate enough to have a convertible Boxter or Jeep need not worry; everyone else may want to consider purchasing a long-enough cable for the GPS unit to sit on the dashboard of their car or rigging the unit with a magnet and affixing it to the roof.

Note 

Don't forget that a GPS unit will do you little good if you don't have proper range with your wireless card to begin with. Hence, if you are going to spend the time, effort, and money to get set up with a war-driving package, including one with GPS mapping software, you should purchase a decent antenna. Refer to the previous section for details and specifics about antennas, their features, and other war-driving specifics.

As with earlier sections in this chapter, we have listed a few of our personal favorites when it comes to finding and purchasing from a GPS vendor. We realize there are many other vendors you can choose from, but the following vendors are our recommendations because of their unique products, such as the Magellan line of GPS devices. Besides, the goal is that by the end of the chapter you will be able to properly design, implement, and use a top-of-the-line war-driving system that even your friends will be jealous of.

Garmin International	http://www.garmin.com
Magellan	http://www.magellangps.com

War-Driving Software

Setting up your war-driving software can be a bit more complicated due to its prerequisite hardware and software installations, mentioned previously. Because war-driving software requires a GPS unit to locate the position of the laptop by the AP as well as the use of AP identification software, setup may prove to be a challenge. However, for wardrivers , allowing for the implementation of GPS units is one of the most useful features you will need. This is true simply because it allows you to map out vulnerable APs for future use or to pinpoint them for hardening.

Because wireless technology (and technology in general) tends to rely on acronyms, you need to be aware of a few simple terms before heading into this section and the rest of the chapter. These terms include SSID, MAC, and IV. The Service Set Identifier (SSID) is used as an identifier to distinguish one access point from another (or in macro-cases, one organization from another). You can think of it as something similar to a domain name for wireless networks. The Media Access Control (MAC) address is the unique address that identifies each node of a network. In WLANs, it can be used as a source for client access control. The Initialization Vector (IV) of a Wired Equivalent Privacy (WEP) packet is included after the 802.11 header and is used in combination with the shared secret key to cipher the packet's data.

NetStumbler, the first publicly available war-driver application, was released as a tool that analyzed the 802.11 header and IV fields of the wireless packet in order to determine the SSID, MAC address, WEP usage, WEP key length (40 or 128 bit), signal range, and potentially the access point vendor. Soon after, a few Linux and UNIX-based tools came out that had similar tactics but also allowed for WEP key cracking and actual packet data cracking. Most of these cracking tools made use of Tim Newsham's discovery and implementation of exploiting key weaknesses in the WEP algorithm and key scheduling algorithm (KSA). Some of the industry-standard war-drivers are listed next. All are different; hence, each has a unique tool feature that you may need in the field.

NetStumbler

Popularity:	9
Simplicity:	9
Impact:	9
Risk Rating:	9

NetStumbler (http://www.netstumbler.com) is a Windows-based war-driving tool that will detect wireless networks and mark their relative position with a GPS. NetStumbler uses an 802.11 Probe Request sent to the broadcast destination address, which causes all access points in the area to issue an 802.11 Probe Response containing network configuration information, such as their SSID and WEP status. When hooked up to a GPS, NetStumbler will record a GPS coordinate for the highest signal strength found for each access point. Using the network and GPS data, you can create maps with tools such as StumbVerter and Microsoft MapPoint. NetStumbler supports the Hermes chipset cards on Windows 2000, the most popular being the Lucent (now Proxim) Orinoco branded cards. On Windows XP, the NDIS 5.1 networking library has 802.11 capabilities itself, which allows NetStumbler to be used with most cards that support it.

To use NetStumbler, insert your wireless card and set your SSID or network name to ANY. For Orinoco cards, this can be found in the Client Manager utility, as shown next. If NetStumbler doesn't detect access points you know are present, check this first before performing other troubleshooting. Setting the Network Name field to ANY tells the driver to use a zero-length SSID in its Probe Requests. By default, most access points will respond to Probe Requests that contain their SSID or a zero-length SSID.

Once the card is configured correctly, start up NetStumbler and click the green arrow on the toolbar (if not depressed already). If there are any access points in the area that will respond to a Broadcast Probe Request, they should respond and be shown in the window. You can use the Filters option to quickly sort multiple networks on criteria such as WEP usage or whether the network is an IBSS or BSS type network. Because an IBSS (Independent BSS) network is a group of systems operating without an access point like a BSS network, an attacker would only be able to access the systems in that network and not necessarily use the wireless network as a bridge to the internal LAN. Selecting any of the networks by their circle icon will also show a signal-to-noise ratio graph (see Figure 8-5).

Figure 8-5: Network Stumbler

NetStumbler Countermeasures

NetStumbler's primary weakness is that it relies on one form of wireless network detection, the Broadcast Probe Request. Wireless equipment vendors will usually offer an option to disable this 802.11 feature, which effectively blinds NetStumbler. Other wardriving software available now, such as Kismet, also use this method but have other detection mechanisms to back them up if they fail. That said, there is still no shortage of networks that can be detected by NetStumbler, and the feature to respond to a Broadcast Probe Request is still enabled by default for many vendors.

Note 

Another newly released tool that may prove useful is Hotspotter. Hotspotter can be utilized to find wireless hotspots or wireless networks; it along with documentation can be downloaded from http://www.remote-exploit.org/downloads/hotspotter-0.4.tar.gz.

Kismet

Popularity:	8
Simplicity:	7
Impact:	9
Risk Rating:	8

Kismet (http://www.kismetwireless.net) is a Linux and BSD-based wireless sniffer that has war-driving functionality. It allows you to track wireless access points and their GPS locations like NetStumbler, but it offers many other features as well. Kismet is a passive network-detection tool that cycles through available wireless channels looking for 802.11 packets that indicate the presence of a wireless LAN, such as Beacons and Association Requests. Kismet can also gather additional information about a network if it can, such as IP addressing and Cisco Discovery Protocol (CDP) names .

Included with Kismet is a program called GPSMap , which generates a map of the Kismet results. Kismet supports most of the wireless cards available for Linux and OpenBSD.

To use Kismet, you will first have to install the custom drivers required for monitormode operation. This can vary depending on the chipset your card uses, but Kismet comes with a single way to enable all of them for monitor operation. Before starting Kismet, run the kismet_monitor script to place your card into monitor mode. Be sure you are in a directory that the Kismet user has access to before starting Kismet:

 [root@localhost user]#  kismet_monitor  Using /usr/local/etc/kismet.conf sources... Enabling monitor mode for a cisco card on eth1 Modifying device eth1 

This will place the wireless card configured in your kismet.conf file into monitor mode. Once Kismet is loaded, the interface will display any networks in range. By default, Kismet will sort the networks in an "Autofit" mode that doesn't let you step through them. Press S to bring up the sort menu and then choose one of the available options; "l" (or latest time seen) works well in most cases. The main window, shown next, displays the network name (SSID). The T column displays the type of network, W signifies whether or not WEP is enabled, and Ch stands for "channel number." The IP Range column shows any detected IP addresses found, either via ARP requests or normal traffic.

Kismet Countermeasures

As far as countermeasures to Kismet go, there aren't many. Kismet is currently the best war-driving tool available and will find networks that NetStumbler routinely misses. In addition to its network-discovery capabilities, it can also automatically log WEP packets with weak IVs for use with AirSnort as well as detect IP addresses in use on the WLAN.

Dstumbler

Popularity:	5
Simplicity:	6
Impact:	9
Risk Rating:	7

Dstumbler (http://www.dachb0den.com/projects/dstumbler.html) is part of the BSD-Airtools package for the OpenBSD, NetBSD, and FreeBSD operating systems. Dstumbler is a war-driving application that supports logging access point locations with a GPS. Support for both Orinoco and Prism2 cards is provided, although the monitor mode support that allows Dstumbler to detect access points that don't respond to a Broadcast Probe Request is for Prism2 cards only. Dstumbler will also report if an access point is using a default SSID, and it has some capabilities to detect whether a network is using 40or 104-bit WEP.

Dstumbler requires kernel patches for monitor mode support on the Prism2 cards for NetBSD and FreeBSD. OpenBSD 3.2, however, includes these modifications in the default kernel. After the bsd-airtools package is installed, you can start Dstumbler by specifying the wireless interface to use:

 foo#  dstumbler wi0 -o -m 30 -l log.txt  

This will start up Dstumbler on the wi0 interface in monitor mode ( -o ), randomly changing the MAC address every 30 seconds ( -m 30 ) and logging to an output file called log.txt ( -l log.txt ). Once the application has loaded, you are presented with an ncurses interface with three main windows, as shown next. At the upper left is a display of detected networks, to the right are the details for the selected network, and below is the real-time signal strength of the selected network. You can move up and down the network list with the upand down-arrow keys.

Dstumbler Countermeasures

When scanning with an Orinoco card, Dstumbler can be blocked if you disable the response to Broadcast SSID requests. When Dstumbler is in monitor mode, however, you will likely not be able to prevent the tool from detecting your SSID. Because Dstumbler can highlight the fact that you are using a default SSID, you should at least change the SSID to something other than the OEM initial setting.

Wireless Mapping

Once you've discovered the available access points, one thing you can do with this data is create maps based on the results of the network and GPS data. War-driving tools will log the current GPS location, signal strength, and attributes of each access point. Based on this data, these tools can guess where the access point is on the assumption that the closer you get to an AP, the stronger the signal will be. Previously, you would need to convert the results from your war-driving tool to a format that a mapping system such as Microsoft MapPoint or the MapBlast website could use to interpret the GPS coordinates. Now, however, software is available that automates this process for you and reads in the data straight from the war-driving tool. In addition to using your own data, some groups have established sites such as http://www.wifimaps.com and http://www.gigle.net to accumulate the information in a large database.

StumbVerter

Popularity:	5
Simplicity:	8
Impact:	2
Risk Rating:	5

StumbVerter (http://www. sonar -security.com) is an application that uses MapPoint 2002 to plot data from files in the NetStumbler format. This saves you the hassle of manually inputting this information into MapPoint or another mapping tool. It also creates NetStumbler-style icons on the map for each access point. Green icons represent nonencrypted networks, and red icons indicate networks using WEP.

To use StumbVerter, click the Import button and select a saved NetStumbler scan (be sure it's one with GPS data; otherwise , StumbVerter will not be able to plot the AP locations). Once the map is loaded you can select View Show All AP Names and Info to get additional information about each network, including the SSID and MAC address. The normal MapPoint 2002 controls are available, so you can zoom and edit the map just like you would in MapPoint. If you are satisfied with the map, you can save it off to a MapPoint file, bitmap, or HTML page (see Figure 8-6).

Figure 8-6: StumbVerter

GPSMap

Popularity:	3
Simplicity:	5
Impact:	2
Risk Rating:	3

GPSMap is included with the Kismet wireless monitoring package. It imports Kismet.gps and network files and then plots the network locations on maps from a variety of sources. GPSMap is probably the most versatile war-driving map generator available and supports many drawing options for each access point. Maps can be made based on the estimated range of each network, the power output, a scatter plot, or all these options together. Although it is extremely flexible, GPSMap can be a bit command-line intensive . To create a map with GPSMap, you'll need some saved Kismet results with GPS data. This would be at least a .network file and a .gps file for a given date and scan. Here's an example:

Kismet-07-2002-1.network and Kismet-07-2002-1.gps.

Once you know which result files you want to use, you'll need to run GPSMap against those files with the right options. The major arguments are the name of the output file ( -o ), what source to take the background map image from ( -S ), and your draw options. Because GPSMap uses ImageMagick, your output file can be in almost any imaginable format, such as JPEG, GIF, or PNG. The background image sources are three vector map servicesMapBlast, MapPoint, and Tiger Census mapsand one photographic source using United States Geological Survey (USGS) maps from Terraserver (http://terraserver.homeadvisor.msn.com). Map sources or drawing options depend on your personal preferences and what you want to do with the map. It's best to try them all out and see which ones best fit your needs.

In the following example, we are creating a PNG map called newmap.png ( -o new-map.png ) using a USGS map as the background ( -S 2 ) to a scale of 10 ( -s 10 ). The drawing options are set to color the networks based on WEP status ( -n 1 ), draw a track of the driven route ( -t ) with a line width of 4 ( -Y 4 ), and map each access point with a dot at the center of the network range ( -e ), making the circle five units wide ( -H 5 ). The last argument is the name of the .gps file to use for input.

 [root@localhost user]#  gpsmap -o newmap.png -s 10 -S 2 -n 1 -t -Y 4  -e -H 5 Kismet-Jan-07-2005-1.gps  

The resulting map will look something like this:

JiGLE

Popularity:	2
Simplicity:	6
Impact:	2
Risk Rating:	3

JiGLE (http://www.wigle.net) is a Java client for viewing data from the WiGLE.net database of wireless networks (see Figure 8-7).

Figure 8-7: JiGLE

WiGLE.net currently has over 160,000 wireless networks listed in its database, which means that if you live in an area with WiGLE data, people wouldn't even have to go wardriving themselves to find your network. JiGLE reads in network and GPS data from WiGLE map packs . By default, it comes with a map pack for Chicago, but you just need to register to download any other available pack for other parts of the country. The client itself can also read in your own NetStumbler or Kismet results file and plot the network points on a map you provide.

To use JiGLE, make sure you have the Java JRE 1.3.0 or above installed and click the run. bat file in the JiGLE directory. Then select from the available map packs using the dropdown menu on the left side of the toolbar. If you'd like to get additional map packs, you'll need to download them from http://www.wigle.net/gps/gps/GPSDB/mappacks.

If you're performing a wireless assessment, it would be a good idea to check the WiGLE database, or other online databases such as http://www.netstumbler.com, for the presence of your access point. Most of the DBs will honor your request to remove your AP.