a Detecting 802.11 Discovery Apps

Walter writes:

"This might be of use to wireless aficionados, from Slashdot :

Joshua Wright writes "I have written a white paper on detecting 802.11 Wireless LAN Network Discovery applications . Wireless LAN discovery through the use of applications such as NetStumbler, DStumbler, Wellenreiter and others is an increasingly popular technique for network penetration. The discovery of a wireless LAN might be used for seemingly innocuous Internet access, or to be used as a "backdoor" into a network to stage an attack. This paper reviews some of the tactics used in wireless LAN network discovery and attempts to identify some of the fingerprints left by wireless LAN discovery applications, focusing on the MAC and LLC layers. This fingerprint information can then be incorporated into intrusion detection tools capable of analyzing data-link layer traffic."

This looks rather interesting, and the focus on layer 2 as opposed to assuming layer 3 use looks of note, as well. Admins of wireless networks will want to incorporate some of this into their IDS monitoring.