GSLC · Question #512
You work as a Network Administrator for Infosec Inc. Nowadays, you are facing an unauthorized access in your Wi-Fi network. Therefore, you analyze a log that has been recorded by your favorite…
The correct answer is A. NetStumbler. The Ethereal capture filter using LLC OUI 0x00601d and PID 0x0001, combined with the payload string 'All your 802.11b are belong to us', are unique identifying signatures of NetStumbler. These characteristics allow network administrators to identify NetStumbler-based…
Question
You work as a Network Administrator for Infosec Inc. Nowadays, you are facing an unauthorized access in your Wi-Fi network. Therefore, you analyze a log that has been recorded by your favorite sniffer, Ethereal. You are able to discover the cause of the unauthorized access after noticing the following string in the log file:
(Wlan.fc.type_subtype eq 32 and llc.oui eq 0x00601d and llc.pid eq 0x0001) When you find All your 802.11b are belong to us as the payload string, you are convinced about which tool is being used for the unauthorized access. Which of the following tools have you ascertained?
Options
- ANetStumbler
- BAiroPeek
- CKismet
- DAirSnort
How the community answered
(27 responses)- A74% (20)
- B15% (4)
- C4% (1)
- D7% (2)
Why each option
The Ethereal capture filter using LLC OUI 0x00601d and PID 0x0001, combined with the payload string 'All your 802.11b are belong to us', are unique identifying signatures of NetStumbler. These characteristics allow network administrators to identify NetStumbler-based unauthorized Wi-Fi probing.
NetStumbler is an active 802.11 network scanning tool for Windows that sends probe frames using an LLC header with OUI 0x00601d (associated with Lucent/Agere chipsets) and PID 0x0001, and embeds the distinctive payload string 'All your 802.11b are belong to us' - both of which match exactly the filter and payload observed in the Ethereal log.
AiroPeek is a passive wireless packet capture and protocol analysis tool that does not inject active probe frames, so it would not produce the LLC OUI or payload signature seen in the log.
Kismet is a passive wireless network detector and sniffer that operates in monitor mode without transmitting frames, meaning it cannot generate the active probe traffic identified in the capture.
AirSnort is a WEP key recovery tool that passively collects encrypted packets to derive keys and does not transmit active probes or embed any such payload string in frames.
Concept tested: NetStumbler wireless scanner identification via packet signature
Topics
Community Discussion
No community discussion yet for this question.