Skip to content

DF and other tools to explore a 2.4GHz environment.

Notifications You must be signed in to change notification settings

0x90/wireless-radar

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

wireless-radar

wireless-radar comes with a few tools:

  • wprox a scanner for detecting/fingerprinting active 802.11 devices
  • mrssi a simple RSSI sensor locking onto a MAC for physically locating the device
  • wscan a direction-finder using a directional antenna mounted on a usb rocket launcher
  • bprox a Bluetooth device discoverer
  • rfdiff to diff the outputs of wprox scans

Installation

pip install wirelessradar

Since wireless-radar tools involve manipulating network devices and setting promiscuous mode, these need to be either run as root, or you can create a copy of your python executable and set capabilities to enable sniffing for user accounts in your virtual environment:

 setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' env/bin/python2

wprox

wprox sniffs on every channel as long as no new devices are found for a preset amount of time. wproxy gathers clients trying to discover, connect to, or communicating with APs, and APs advertising themselves or communicating with clients. It also collects the ESSIDS of access points the clients try to connect to (affects mostly Apple products).

screenshot of wprox output

Using wprox it is possible to have a more granular look into all channels and their users. It allows for selecting a more quiet channel for your own network, discovering less congested access points at conferences, and generally map the wifi spectrum.

wprox has the following dependencies which are automatically handled by the setup script:

scapy netaddr git+https://github.com/pingflood/pythonwifi.git

before you run, you must set your wlan device to monitor mode:

iwconfig wlan0 mode monitor

alternatively you can also create a seperate monitor device using:

airmon-ng start wlan0
ifconfig wlan0 down

you can then run wproxy like this:

./wprox.py <device>

replacing with wlan0 or mon0 depending on your setup.

should result in output like this:

typ AP SSID*                      MAC               vendor                  channels              cnt  max  min  avg  sp rssi   flg attempts
AP 'TP-LINK_ffffff'               ff:ff:ff:ff:ff:ff TP-LINK TECHNOLOGIES    [3-7,9,11          ] 3511  -36  -80  -40 44 [███  ]
                                  ff:ff:ff:ff:ff:ff Apple, Inc.             [6                 ]   15  -73 -100  -84 27 [▊    ]     'TP-LINK_ffffff'
AP 'WifiZone1234567'              ff:ff:ff:ff:ff:ff Routerboard.com         [11                ]  178  -90  -94  -92  4 [█▌   ]
CL                                ff:ff:ff:ff:ff:ff Samsung Electronics     [3,9               ]   12  -81  -90  -89  9 [██▋  ]     'ap1', ''

where the first column denotes

  • AP for access points
  • nothing for associated clients
  • CL for non-associated clients
  • NA for unknown roles

for APs this is followed by the AP ESSID, and then for all device types

  • the MAC,
  • the vendor according to the MAC,
  • a list of channels this device has been observed,
  • the number of packets counted
  • strongest signal,
  • weakest signal,
  • average signal,
  • difference between strongest and weakest signal,
  • 5 char graphical signal strength indicator.
  • optional flags (C= wireless camera, D=drone)

For client devices this is followed by a list of ESSIDs the device tried to associate with.

While wprox is running it dumps the found devices to stderr every 1 second if there's some traffic on the chan. At the end wproxy outputs all devices again, but this time to stdout so you can save one copy in a file.

mrssi

mrssi allows you to lock onto one specific MAC address on a specific channel and shows you the signal strength with a bargraph and a histogram of the signal strength over the last 40 seconds:

./mrssi.py mon0 01:23:45:ff:ff:ff 6
WARNING: Failed to execute tcpdump. Check it is installed and in the PATH
WARNING: No route found for IPv6 destination :: (no default route?)
looking for 01:23:45:ff:ff:ff on mon0 chan: 6 (2.437GHz)
-75  ████████████▋                           | -79  ▃▃▂▂▂▂▂▁▁▁▁▂▄▄▄▃▄▄▃▆▅▅▄▅▅▂▆▇▅▅▆▅▅▅▄▄▃▂▁▁ -52

wscan

run with::

./wscan.py | tee logs/home-$(date '+%s').log | ./wscan.py load

or tracking a specific AP:

./wscan.py 00:00:00:00:00:00 | tee logs/home-$(date '+%s').log | ./wscan.py load

this gives you realtime feedback on RSSI strength for a given BSSID.

The 1st invocation of wscan drives the rocket-launcher mounted antenna to do 2 full scans left-right and back, this outputs a log of seen APs in this format:

x y timestamp bssid rssi essid

so in theory if you can produce a similar output, you don't need the 1st invocation and also no rocket launcher. You can also replay earlier scans, or combine multiple scans into one, etc.

In any case you get this output, where the colums are the following:

  • sparkline of avg RSSI in directions from 0 to 340 deg
  • x direction of strongest RSSI signal
  • y direction of strongest RSSI signal
  • timestamp
  • [omitted] BSSID of AP
  • strongest RSSI signal
  • [omitted] ESSID of AP
|█▃▁▅▃▃              |  200   0 2012-02-04T03:45:24 -91
|▄▄▄▄▄▄ ▄█  █ ▄  ▄▄▄▄|  300   0 2012-02-04T03:29:46 -89
|▆▆▆▂▂▂ ▄█▆▄▄▄█▄▄▄▂▄▂|  400   0 2012-02-04T03:22:53 -87
|▃▄▆▇▇█▇▇▃▃▃▃▆▇▇▆▄▃▁ |  400   0 2012-02-04T03:45:09 -81
|▄▆▇██▇▆▆▃▇ ▇▇ ▄▃▃▄▃▁|  600   0 2012-02-04T02:40:47 -85
|    █▁ ▃▃▃          |  700   0 2012-02-04T03:30:14 -89
|▇█▅▃▇██▇▃▁▇█▇▇▃▁▁▁▁ |  800   0 2012-02-04T03:44:41 -81
|▃▃▆▆████▆█          |  800   0 2012-02-04T02:30:33 -89
|    █▄▄▄            |  800   0 2012-02-04T02:36:19 -93
|    ▃█              |  800   0 2012-02-04T02:36:17 -93
|▁▄▄▄▆███▇▆▄▃▃▄▃▃▁▁ ▁|  800   0 2012-02-04T02:36:17 -87
|▃▅▆▇▇▇▇▇▇▅▅▅▇█▇▅▃▃▁ |  800   0 2012-02-04T02:40:56 -83
|   ▆▆▅▃▃ ▆▇█▆▆▃▂▂▁▁▁|  900   0 2012-02-04T03:30:31 -91
|     ▃▃ ██          |  900   0 2012-02-04T02:30:41 -93
| ▁▄▇████▅▄▃▂▃▄▆▇██▆▄|  900   0 2012-02-04T02:36:24 -77
|▃▂▄▇▇██▆▄▃▂▂▂▃▂▂    | 1000   0 2012-02-04T03:30:35 -79
|     ▄█▄▄           | 1000   0 2012-02-04T03:38:54 -91
|▃▃▃█▆████▆  ▃▃▃▃▃▃▆▃| 1000   0 2012-02-04T02:55:26 -89
|▆▃▆▃▆███▆▆▆█▃▃ ▃▃▆█ | 1000   0 2012-02-04T02:36:33 -89
|    ▄▅▆▆▆▄▄▅▆█▄▃▄▂▁ | 1000   0 2012-02-04T03:52:56 -87
|  ▃▇███▇▅▅▇▅▅▃▃▅▇▇▇▅| 1000   0 2012-02-04T02:41:10 -79
|▃ ▁▁▄▇▇▆▃▄▄▄▄▆▄█   ▁| 1000   0 2012-02-04T02:30:48 -87
|  ▆▄▆▇██▇▇         ▁| 1000   0 2012-02-04T02:36:33 -85
|     █▄▂▂▄▄         | 1000   0 2012-02-04T02:36:32 -91
|  ▅▄▄▅▇███▇▅▄▄▄▃▃▁▂▂| 1000   0 2012-02-04T02:36:30 -83
|▁▂▁▂▄▅▇▇▇███▆▄▄▄▂▂ ▄| 1100   0 2012-02-04T02:30:57 -81
|▃▂▁▃▅▆▇▇█▇▆▅▅▃▃▂▃  ▂| 1100   0 2012-02-04T02:30:53 -87
|     ████           | 1100   0 2012-02-04T03:23:41 -91
|▆▅▄▂▃▆███▄▂▄▇▇▇▃▁   | 1100   0 2012-02-04T02:30:54 -75
|      ██            | 1100   0 2012-02-04T03:53:02 -95
|    ▄▆▇██▇▆▆▃▁▆     | 1100   0 2012-02-04T02:36:36 -87
|    ▄▄▄▄▄▂▆█        | 1100   0 2012-02-04T02:30:57 -91
|      ▄█            | 1100   0 2012-02-04T03:30:44 -93
| ▁▃▅▆▇████▇▆▄▂▁    ▁| 1100   0 2012-02-04T02:30:57 -75
|▃▁▁▃▃▅▇▇███▇▇▅▅▃▃▁▁ | 1200   0 2012-02-04T02:31:01 -87
|   ▇▇███▇▅      ▁▁  | 1200   0 2012-02-04T03:15:52 -87
|  ▁▁▅▅▅▅▆█    ▃▃▃▃  | 1200   0 2012-02-04T02:30:59 -91
| ▃▆▅▆▇▇▇▇▆▆▆▇█▇▇▅▁  | 1200   0 2012-02-04T02:47:28 -87
|▃▂▂▅▆▆███▇▇▇▇▇▅▅▂▂ ▂| 1200   0 2012-02-04T03:58:13 -83
| ▁  ▁▄▇███▇▆▄▃▁  ▁▄▄| 1200   0 2012-02-04T02:30:59 -75
|       ▁▁▃▅▅▃▅▁▁▇█  | 1200   0 2012-02-04T02:36:46 -89
|▁▃▅▅▇▇██▇▇██▇▅      | 1300   0 2012-02-04T02:31:10 -87
|     ▃▅▇████▇▅▅▁▁   | 1300   0 2012-02-04T02:31:11 -87
|       ██           | 1300   0 2012-02-04T03:53:17 -95
|   ▁▃▆▇▇███▇▄▁▁▂▂▂▁ | 1300   0 2012-02-04T02:36:54 -73
|    ▅▅▇███▇▅▅▁▁▃▃▃▃▃| 1300   0 2012-02-04T03:44:06 -85
|▂▃▄▅▅▄▄▅▅▇▇▇█▇▇▅▃▁▁ | 1400   0 2012-02-04T02:41:40 -79
|        ██          | 1400   0 2012-02-04T02:37:01 -91
|        ██          | 1400   0 2012-02-04T02:36:59 -97
|        ██▆▃        | 1400   0 2012-02-04T02:41:39 -91
|▁▁▁▁▄▆▇▇██▇█▆▆▄▆▃▃  | 1400   0 2012-02-04T02:55:51 -85
|       ▃███▆▆▆▃     | 1400   0 2012-02-04T02:37:00 -87
|     ▃▃▃▆▆█▆▃       | 1400   0 2012-02-04T02:41:37 -89
|      ████          | 1400   0 2012-02-04T02:41:38 -93
|    ▄▄▆██▆▄▆▂▂▂     | 1400   0 2012-02-04T02:41:39 -85
|▂▂▂▂▂▄▆▆████▆▄▂    ▂| 1400   0 2012-02-04T02:31:16 -85
|▃▄▁▃▄▄▄▆████▆▅▄▃▃▂ ▃| 1500   0 2012-02-04T02:37:08 -83
|▁▁  ▁▂▄▅████▅▄▄▄▂▁  | 1500   0 2012-02-04T02:41:47 -77
|        ██          | 1500   0 2012-02-04T02:47:49 -95
|   ▁▃▅▇▇▇▇▇▇▅▅█     | 1500   0 2012-02-04T03:53:29 -87
|        █▄          | 1500   0 2012-02-04T02:31:20 -93
|       ▄▄█          | 1500   0 2012-02-04T03:31:10 -93
|        █▅▁▁        | 1500   0 2012-02-04T03:39:31 -91
|▁▁  ▃▄▄▆█████▇▆▄▃▂▃ | 1500   0 2012-02-04T02:47:48 -79
|       ▆▆▆█▆▆▃      | 1500   0 2012-02-04T02:37:05 -87
|▁▂  ▄▂▃▅▇███▇▅▄▄▄▄  | 1500   0 2012-02-04T02:55:58 -83
|  ▃▃▁▃▃▅▅▇▇██▇▅▃    | 1600   0 2012-02-04T02:37:11 -89
|    ▃▄▄▆▇██▇▅▄▂▂  ▃▁| 1600   0 2012-02-04T03:24:15 -79
|▁▁   ▁▂▃▄▇█▇▆▆▄▃▂▂▁▃| 1600   0 2012-02-04T03:24:14 -83
|▅▅▅▅▄▄ █▇▆▆▆▆▆▅▄▄▂▂▁| 1600   0 2012-02-04T03:24:13 -87
|▄▄▃▃▄▆▇▇██▇▇▆▆▃▁    | 1600   0 2012-02-04T02:56:07 -85
|       ▃▁▇█▇        | 1600   0 2012-02-04T02:56:04 -91
|     ▁▁▆▆▇█▆▆▆▆▆▆▃▄▄| 1600   0 2012-02-04T03:24:15 -87
|        ▇█▇▇▇▆▄▆▃▁  | 1700   0 2012-02-04T02:37:17 -87
|▃▃ ▁▁▃▄▅▅▅▆▇▆▅▃█▅▇▄▃| 1700   0 2012-02-04T03:16:28 -87
|▁▁▂ ▂▃▅▆████▆▅▃▂▁▁▂▁| 1700   0 2012-02-04T03:53:40 -77
|        ██          | 1700   0 2012-02-04T03:57:39 -93
|     ▁▁▃▅▇█▅▅▁▁▃    | 1700   0 2012-02-04T03:24:23 -87
|▅▅▅▅▅▅▅▆▇███▆▄▂   ▃▃| 1700   0 2012-02-04T02:31:33 -61
|   ██   █▄▆▆█▄▄▂▂▄▄▂| 1700   0 2012-02-04T02:41:57 -89
|▄▃▂▃▂▂▃▅▇████▇▆▄▃▂▃ | 1800   0 2012-02-04T03:24:26 -83
|       ▄▄▄▄█        | 1800   0 2012-02-04T03:43:36 -89
|     ▂▂▄█████▆▂▄▆▆  | 1800   0 2012-02-04T03:39:52 -87
|      ▅▇▇▇██▇▅▅▅▅▅▁ | 1800   0 2012-02-04T02:42:06 -91
|▆▆▃▂▄▇█▇▅▅▇▇▅▃▁ ▁▁▂▃| 1800   0 2012-02-04T03:16:34 -81
|          █▇▁▅▅▁▃▅  | 1800   0 2012-02-04T02:31:40 -91
|   ▁▁▁▁▂▅▇████▇▅▃▂▂▃| 1800   0 2012-02-04T02:31:41 -71
|▁▁ ▅▅  ▅▇████       | 1800   0 2012-02-04T02:31:41 -91
|         ▃▃████     | 1800   0 2012-02-04T02:37:28 -93
|  ▃▃▁▁▃▅▇▇██▇█▇▃▁▁▁▁| 1900   0 2012-02-04T03:31:38 -85
|          ▃▆█       | 1900   0 2012-02-04T02:37:31 -91
|▁  ▁▂▃▃▁▂▅▇██▇▆▃   ▁| 1900   0 2012-02-04T02:56:27 -73
|    ▆▆▃▃▃▆▆█▃       | 1900   0 2012-02-04T02:42:14 -89
|▂▂▁▁▁ ▃▅▅▅▆█▇▇▅▃▂▁▃▁| 1900   0 2012-02-04T02:48:14 -85
|        ▄▆▇██▇▆▃▁▁  | 1900   0 2012-02-04T02:56:25 -85
|          █▆▃  ▃▃▃  | 1900   0 2012-02-04T03:39:55 -95
|     ▁▁▆▇▇▇██▇▆▆▆▄▄▇| 1900   0 2012-02-04T02:48:15 -87
|           █▆▃▃     | 1900   0 2012-02-04T02:42:13 -93
|          █▆▃       | 2000   0 2012-02-04T03:57:16 -91
|  ▁▁▁  ▂▄▇██▇▄▁     | 2000   0 2012-02-04T03:16:46 -73
|▆▄▃▁ ▃▁▁▄▆▆▆█▇▆▁▁▄▆█| 2000   0 2012-02-04T02:56:32 -83
|▆▆  ▁▃▆▆▇███▇▇▆▄▃▁▃▆| 2000   0 2012-02-04T02:31:54 -87
|▁▂    ▁▃▄▇█████▆▅▃▁ | 2000   0 2012-02-04T02:56:35 -79
|         ▆█▆▃▆▃▆    | 2100   0 2012-02-04T02:42:29 -91
|▁▃▂▂▂▃▄▄▆▇████▇▆▃▁  | 2100   0 2012-02-04T03:31:50 -73
|  ▃▅▃▅▅▅▇█▅▇██▇▃▅▅▃▃| 2100   0 2012-02-04T02:37:45 -89
|            ██      | 2100   0 2012-02-04T03:24:51 -91
|   ▃▃▁▁▁   ██▇▅▅▃▅█ | 2100   0 2012-02-04T03:43:11 -87
|▃ ▆▆▆▃▃ ▆▃▃▆██▆▆▃  ▃| 2100   0 2012-02-04T03:43:11 -89
|  ▁▁▃▁▄▄▆▆███▆▄▄▃▃▃▄| 2100   0 2012-02-04T02:32:02 -87
|   ▁▁▃▆▆██▇▆▆▁▁     | 2100   0 2012-02-04T02:48:29 -83
|▄▃  ▃▄▄▄▄▆▆▆▇█▇▆▆▄▃▃| 2100   0 2012-02-04T03:24:48 -87
|         ▂▂▆▆█▆     | 2100   0 2012-02-04T02:42:29 -91
|            ███     | 2200   0 2012-02-04T03:31:56 -95
|▂▂▁  ▂▄▄▃▂▄▆████▇▅▂ | 2200   0 2012-02-04T03:57:04 -71
| ▅▅    ▅▅▅▅▅▆█▅▆▃▁ ▃| 2200   0 2012-02-04T02:32:09 -85
|           ██       | 2200   0 2012-02-04T03:57:06 -95
|       ▅▁▁ █▅▃▃▁▁▁  | 2300   0 2012-02-04T02:32:18 -91
|▃▂▂▃▄▃▁ ▂▅▇████▆▃▂▃▆| 2300   0 2012-02-04T02:42:42 -71
|▆ ▃▆▇▆▆▇▇▆▆▇▇▇▆▄▄▄█▄| 2300   0 2012-02-04T02:48:41 -85
|           █▄▄██    | 2300   0 2012-02-04T02:32:18 -91
| ▃▃▁▃▅▅▅▇▅▅▇██▇▅▃▃  | 2300   0 2012-02-04T03:40:25 -89
|▁▃▃▃▃▁▁▃▁▃▃▇▇█▇▃▁ ▁▃| 2300   0 2012-02-04T02:32:15 -85
|            ███▆▃█▆ | 2300   0 2012-02-04T02:37:59 -91
|             ██     | 2300   0 2012-02-04T03:25:05 -95
|▃▃▃▄▃▃▃▅▅▇▇██▇▇▅▅▄▁ | 2400   0 2012-02-04T03:17:16 -85
|              ██    | 2400   0 2012-02-04T03:32:10 -93
|        ▆▆▆█▆▆▄▄▂▂▂▂| 2400   0 2012-02-04T02:32:21 -89
| ▂▆▆▄▂▂▂▄▄▆▄▄▆██▆▄  | 2500   0 2012-02-04T03:40:40 -83
| ▁▃▅   █▇▇█████▇▅▅▅▅| 2600   0 2012-02-04T02:49:04 -87
|▃▃▃▂▃▃▂ ▆▆▆▇▇▇█▆▆▅▃▂| 2900   0 2012-02-04T02:43:23 -85
|▄▄▃▄▃▃▃   ▄▅▇▆▇▇███▆| 2900   0 2012-02-04T03:17:50 -59
|  ▃██ ▃▆▆██▆▃▆▃▃▆▆▆▃| 3400   0 2012-02-04T02:49:55 -85

bprox

bprox listens for bluetooth devices in your vicinity and reports them back. bprox depends on pybluez which is automatically handled by the setup script.

the output contains the MAC address, the RSSI, the device class in hex, the device name, the device type, the advertised services, and the json representation of an SDP query of the device.

python bprox.py
01:23:45:67:89:ab -52 5a0204 'bluetooth enabled phone' phone object transfer service|networking service|capturing service|telephony service [{'protocol': 'L2CAP', 'name': 'AV remote control', 'service-id': None, 'profiles': [('110E', 256)], 'service-classes': ['110C'], 'host': '01:23:45:67:89:ab', 'provider': 'SAMSUNG', 'port': 23, 'description': None}, {'protocol': 'RFCOMM', 'name': 'Voice GW', 'service-id': None, 'profiles': [('00001108', 257)], 'service-classes': ['1112', '1203'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 2, 'description': None}, {'protocol': 'RFCOMM', 'name': 'Serial Port', 'service-id': None, 'profiles': [], 'service-classes': ['1101'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 4, 'description': None}, {'protocol': 'RFCOMM', 'name': 'Dial-up networking', 'service-id': None, 'profiles': [('00001103', 256)], 'service-classes': ['00001103'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 1, 'description': None}, {'protocol': 'L2CAP', 'name': 'Audio/Video Service', 'service-id': None, 'profiles': [('110D', 258)], 'service-classes': ['110A'], 'host': '01:23:45:67:89:ab', 'provider': 'SAMSUNG', 'port': 25, 'description': None}, {'protocol': 'RFCOMM', 'name': 'SIM Access', 'service-id': None, 'profiles': [('112D', 258)], 'service-classes': ['112D', '1204'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 3, 'description': None}, {'protocol': 'RFCOMM', 'name': 'Voice gateway', 'service-id': None, 'profiles': [('111E', 261)], 'service-classes': ['111F', '1203'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 6, 'description': None}, {'protocol': 'RFCOMM', 'name': 'OPP', 'service-id': None, 'profiles': [('1105', 256)], 'service-classes': ['1105'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 8, 'description': None}, {'protocol': 'RFCOMM', 'name': 'OBEX FileTransfer', 'service-id': None, 'profiles': [('1106', 258)], 'service-classes': ['1106'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 9, 'description': None}, {'protocol': 'RFCOMM', 'name': 'Phonebook Access PSE', 'service-id': None, 'profiles': [('1130', 256)], 'service-classes': ['112F'], 'host': '01:23:45:67:89:ab', 'provider': None, 'port': 10, 'description': None}]

rfdiff

rfdiff takes two output files from wprox and compares them while ignoring insignificant differences, see the source.

to run consecutive wproxy scans with a diff to the previous scan can be achieved by:

prev=logs/w$(ls logs/w* | tail -1 | cut -dw -f2); date=$(date +%Y%m%d%H%M); python wprox.py mon0 >logs/w$date ; ./rfdiff.py $prev logs/w$date

About

DF and other tools to explore a 2.4GHz environment.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%