hi,
i wondered for a while, why our (mac whitelist based) network-intrusion
rarely reports unknown mac adresses on our internal network.
i found, that when you just try to login into our internal wifi with wrong
password, i see frames (apparently from the non-authenticated device) appear
on layer2.
i'm not deep enough into wifi and wanted to dig into this, but have
difficulties finding appropriate information.
from my basic understanding of security and "layers" i'm really surprised to
"see some foreigner inside my house while he has no key for the front door"
maybe somebody has a clue or a right keyword where to look further...!?
roland
# tcpdump -ni eth2 ether host 3c:8b:fe:44:37:29 -s0 -X
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
16:44:41.662985 3c:8b:fe:44:37:29 > Broadcast Null Unnumbered, xid, Flags
[Response], length 46: 01 00
0x0000: 8101 0000 0000 0000 0000 0000 0000 0000 ................
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0020: 0000 0000 0000 0000 0000 00 ...........
16:45:07.100952 3c:8b:fe:44:37:29 > Broadcast Null Unnumbered, xid, Flags
[Response], length 46: 01 00
0x0000: 8101 0000 0000 0000 0000 0000 0000 0000 ................
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0020: 0000 0000 0000 0000 0000 00 ...........
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
