Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Tips
Once you’ve virtually found a WiFi device of interest, there’s still the pesky matter of physically finding it. Your first instinct may be to grab a directional antenna and use it to try and point to the device and "follow your nose." The problem with this approach is that signals bounce around, especially inside a building. While the strongest signal may be picked up from a directional antenna pointing in one direction, it may really be a reflected signal leading you completely the wrong way.
A better way to find wireless devices is based on the signal strength of the device when you’re using an omnidirectional antenna (or no antenna at all). Tools like Kismet provide a means to constantly monitor signal strength on any device you choose. Because the signal strength will generally decrease as you get farther from the transmitter, you get to play a game of "hot and cold" with the device you’re trying to find. Pick a direction and go that way for a while. If the signal strength gets worse, you’re going the wrong way. It’s not an exact science, but it can yield decent results if you try.
Another thing to seek is devices with "geeky" names or traits. MAC addresses like DEADBEEF0000 are definitely not normal; at the very least, they signify a user who knows a bit about networks. At worst, it’s an attacker. Keep an eye out for things out of the norm, because they may be signs of something bad going on.
Also, take a look for clients probing for networks (in Kismet, these are under Probed Networks). These clients may be devices having problems staying connected, or even devices that are connected to your wired network but have a wireless interface active and looking for a home. You’ll often see SSIDs of Home, linksys, or something else that doesn’t look like it belongs. These are clients you may want to find and try to shut down.