List of Figures

Chapter 2: Radio Frequency

Figure 2-1: Block diagram of basic communications system
Figure 2-2: The process of upconverting a modulated baseband signal into a modulated RF signal
Figure 2-3: Time-domain waveform of a sinusoidal voltage
Figure 2-4: Phase shift between two sinusoids
Figure 2-5: Time-domain plot of RF voltage (envelope)
Figure 2-6: Frequency-domain plot of 802.11a 54-Mbit/sec signal
Figure 2-7: Baseband audio signal
Figure 2-8: Resulting AM modulated RF signal
Figure 2-9: Baseband input signal
Figure 2-10: Resulting FM modulated RF signal
Figure 2-11: Process of dividing a digital bitstream into individual symbols using 16-QAM modulation
Figure 2-12: Constellation diagram showing the transition between symbols
Figure 2-13: Constellation diagrams for BPSK (on left) and QPSK (on right)
Figure 2-14: Constellation diagrams for 16-QAM and 64-QAM signals
Figure 2-15: Using different channels for different signals
Figure 2-16: The temporal multiplexing scheme used in TDMA
Figure 2-17: Azimuth radiation plot
Figure 2-18: Elevation radiation plot
Figure 2-19: Graphical depiction of every frequency allocation in the United States (http://www.ntia.doc.gov/osmhome/allochrt.pdf)

Figure 3-1: The hidden node problem
Figure 3-2: Collision that can be avoided using RTS/CTS packets
Figure 3-3: Successfully avoiding a collision
Figure 3-4: Wireshark decoding of an ACK packet-notice it is only 10 bytes
Figure 3-5: Wireshark decoding of a data packet
Figure 3-6: A typical beacon packet
Figure 3-7: Authentication/association phase in a typical 802.11 network
Figure 3-8: Dialup authentication using EAP
Figure 3-9: Mapping dialup authentication to wireless authentication
Figure 3-10: EAP request/response format
Figure 3-11: Simple EAP authentication exchange
Figure 3-12: Authentication using RADIUS
Figure 3-13: Sample authentication exchange between a dialup user and authentication server
Figure 3-14: Authentication using 802.1X on an Ethernet-based LAN
Figure 3-15: Simplified association and authentication exchange in 802.11i-protected networks
Figure 3-16: EAP-TLS authentication
Figure 3-17: Simplified four-way handshake provides only authentication.
Figure 3-18: The 802.11i four-way handshake
Figure 3-19: Packet processed by 802.11i

Figure 4-1: A directed probe request-note the addition of an SSID parameter.
Figure 4-2: A typical broadcast probe request packet
Figure 4-3: Wi-Spy in action. Note the relative quiet at the high end of the spectrum-the area that represents traffic on channels 12 and 13. There is nothing on these channels because this screenshot was taken inside the U.S. where these channels cannot be used.
Figure 4-4: Antenna and pigtail connectors
Figure 4-5: Configuring a 2.6 Linux kernel for a Garmin GPS or KeySpan USB-to-serial converter support
Figure 4-6: Windows successfully detecting a KeySpan USB converter

Figure 5-1: NetStumbler's main window
Figure 5-2: Using a different driver, the hidden networks no longer show up in NetStumbler.
Figure 5-3: NetStumbler's SNR display. The current card uses arbitrary units, not dBm.
Figure 5-4: HyperTerminal shows the serial port and GPS device are working correctly.
Figure 5-5: A basic map made with StumbVerter
Figure 5-6: NetStumbler's main configuration dialog
Figure 5-7: The Broadcom configuration client is in a good state for war driving. Your own client may look different.
Figure 5-8: This dialog, accessed via Control Panel, will let you disable TCP/IP temporarily.
Figure 5-9: Kismet in action
Figure 5-10: GpsDrive is successfully communicating with Kismet.
Figure 5-11: Wellenreiter in action. The interface has clearly been influenced by NetStumbler.
Figure 5-12: MacStumbler at work. Note that the networks it currently detects are exactly the same ones that you would see by clicking the airport logo and viewing the surrounding networks.
Figure 5-13: Ethereal with customized colors enabled

Figure 6-1: aircrack's main display. The low numbers for the votes means that aircrack doesn't have a good idea what the key is yet.
Figure 6-2: Even though Windows says this user is not connected, he is.

Figure 7-1: A successful four-way handshake, using a PMK derived from a passphrase
Figure 7-2: A generic WPA enterprise authentication exchange. The AP must proxy authentication packets between the client and RADIUS server.
Figure 7-3: Example PEAP authentication exchange
Figure 7-4: Overview of a PEAP certificate authentication failure attack
Figure 7-5: Setting the RADIUS shared secret for an AP. Make sure it's a good one.

Figure 8-1: A typical configuration for a Linksys AP. The Shared Key here is the shared RADIUS secret
Figure 8-2: PEAP has been configured to not validate the user's certificate and not use any automatic authentication methods. Be sure to re-enable certificate validation once you are done debugging

Figure 9-1: Hotspot architecture
Figure 9-2: You can't always trust the SSID.
Figure 9-3: NetStumbler in action
Figure 9-4: Viewing signal strength in NetStumbler
Figure 9-5: Using Ettercap to eavesdrop
Figure 9-6: A method for ensuring privacy when using a hotspot-or to evade those pesky billing mechanisms…
Figure 9-7: Decoding the TCP stream in Wireshark
Figure 9-8: ipconfig results
Figure 9-9: The web server we found
Figure 9-10: The Nessus Scan Report
Figure 9-11: nessus scan details
Figure 9-12: Configuring Cisco's public secure packet forwarding