Detecting or Scanning for Clients

Archived from groups: alt.internet.wireless (More info?)

On Tue, 19 Oct 2004 13:20:55 GMT, johnk@pceffect.co.uk (John F
Kappler) wrote:

>I "look after" 3 or 4 wireless networks.

You have my sympathy. The ones I deal with send me some of the
weirdest problems. I'm still not sure if it's the technology, the
weird customers, or the weird things RF does to peoples brains.

>Is there any utility software around that would give the status of
>clients currently talking to an access point?

>The particular case I'd like it for is a D-Link DWL2100AP which I can
>access wired from a PC.

The DWL-2100AP supports SNMP (simple network manglement protocol). In
theory, you could browse the MIB tree and find the MAC addresses of
the connected radios. In reality, DLink has not seen fit to release
the necessary MIB database and has only partial functionality in the
ASN.1 primitives. Therefore, methinks SNMP would have been the right
way to do monitoring, but not with this particular device.

Some interesting SNMP stuff for wireless:
http://ap-utils.polesye.net

Next best is sniffing the traffic between your access point and
router. What you'll see is the un-encapsulated 802.3 ethernet packets
from the clients complete with their MAC addresses and IP addresses.
There doesn't seem to be much in the way of monitoring software for
Windoze. This looks good.
http://www.otosoftware.com/wireless.asp ($40)
I tend to use arpwatch (Linux) for detecting new MAC addresses, but
its output is ugly and needs to be post-processed. The large system
monitoring utilities (OpenView, OpenNMS, Nagios, Unicenter TNG, etc)
are SNMP based, which doesn't work well on your DWL-2100AP, and are
probably overkill.

Even if I would write a sniffer that provided you with a table of
connected users and whatever info I could find about them, there is a
limitation to sniffing between the AP and the router. If a client
radio connects, I would have no way of knowing whether they are still
connected other than concocting some kind of expiration timeout timer.
Similarly, a user could connect, but not move any traffic, and you
would not see much between the AP and router. Monitoring should
really be done in the access point.

There may be a "probe" (program that sniffs traffic and reports
results) for some major monitoring packages. I've used these for MRTG
and RRDTool, but they don't product the output methinks you want.


>p.s. Sorry if this has been asked before, but I did do a scan, plus a
>Google, but didn't find and appropriate results.

Yeah, I know the problem. I often can't even find my own postings.


--
Jeff Liebermann jeffl@comix.santa-cruz.ca.us
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558

Archived from groups: alt.internet.wireless (More info?)

On 22 Oct 2004 03:03:49 -0700, dave_arraya@hotmail.com (Dave) wrote:

>johnk@pceffect.co.uk (John F Kappler) wrote in message news:<417513ed.1817936359@giganews.nildram.co.uk>...
>> I "look after" 3 or 4 wireless networks.
>> Is there any utility software around that would give the status of
>> clients currently talking to an access point?
>> The particular case I'd like it for is a D-Link DWL2100AP which I can
>> access wired from a PC.

>Yo can check tool called NetCrunch
>(http://www.adremsoft.com/netcrunch/index.php). It show you who is
>currently using a connection in switch and i think that it can be used
>for access point, too. You can check it,there is full 30-day trial
>version available.
>dave

$1200 for one mangement workstation. Ouch.
Methinks it would be cheaper to just buy an access point that does
SNMP (Proxim, Cisco, any of the wireless switch vendors, etc).


--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831.336.2558 voice http://www.LearnByDestroying.com
# jeffl@comix.santa-cruz.ca.us
# 831.421.6491 digital_pager jeffl@cruzio.com AE6KS