NetStumbler Vs. Windows Wireless Connect.

Archived from groups: alt.internet.wireless (More info?)

On Sat, 09 Oct 2004 06:06:17 GMT, "Benny" <biteme@aol.com> wrote:

>why it is that when I run NetStumbler I get 4 wireless networks with
>approximately the same signal strength and other specs and none with
>encryption, but When I try to connect with Windows Wireless Networking I
>only see one of them. I connect to to this one network fine but with very
>low signal strength.
>
>Anybody know why it is that I see the Networks in NetStumbler but not in
>Windows? And is there any way I can get Windows to connect to them anyway?

I'll assume Netstumbler 0.4.0 and Windoze XP Home with SP2. Some clue
as to your wireless device vendor and model would be interesting.

I did some testing with Netstumbler and used FakeAP (under Linux) to
generate a large number of fake access points with individual SSID's.
Nestumbler will query the (fake) access point for its SSID with a
broadcast probe. The access point returns a few packets as part of
the exchange. Netstumbler records everything it can extract from the
management header. This only requires a few (I think it's 3 but I'm
not sure) packets.

However, when Windoze goes out and searches for access points, it does
a bit more. It apparently looks for a half way stable signal and
multiple successful responses typical of a working access point. When
I used Windoze XP SP2 to query the FakeAP access point using single
SSID per query responses, instead of a huge number of fake SSID's, it
only showed a rather small number. I vaguely recall it was something
like 15 out 3,000 generated. When I allowed it to return duplicated
SSID's for consecutive probes, XP showed thousands of SSID's.

Apparently (this is a guess, this is only a guess), Windoze wants a
better quality and more stable exchange before it will declare an
access point to be available. However, Netstumbler will report
literally anything and everything that it hears.

Just to make life interesting, there are some access points that can
be set to not respond to consecutive identical broadcast probes every
time. This seems to be a feature in one of the customer WRT54G
firmware packages. Apparently, the idea is to show the SSID when
Windoze probes for access points, but not respond to more than a few
Netstumbler probes. I haven't played with this, but it sounds like an
interesting compromise between SSID hiding (which is a lousy security
idea and has side effects), and SSID broadcasting (which is how
Netstumbler works).



--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831.336.2558 voice http://www.LearnByDestroying.com
# jeffl@comix.santa-cruz.ca.us
# 831.421.6491 digital_pager jeffl@cruzio.com AE6KS