Kismet Wireless

Kismet Forums

 

Posted by:reddiepenguin
Subject:Cisco Wireless Devices show up on multiple channels?
Date:00:09:47 07/12/2009

Thank you again for all your information and time.

I have no doubt at all this is one big network though, because every single BSSID comes back to CISCO devices and it's not a simple name like "linksys" but actually the company's name.

I looked at my logs again and I found 1 AP on Ch. 1, 2 on Ch. 6, and two more on Ch 11.

I guess if you have only one card, it's channel hop or else.

> > I see what you mean now but this network comes up with the same SSID like 6-8 times each one saying either ch 1, 6, or 11.
>
> Multiple APs on the same SSID make up a multi-AP network for roaming. This is how wireless works. They are not the same AP, they *may* not even be the same network (for example, 'linksys').
>
> >
> > If you wanted to scan a network like that, how would you do that?
>
> Like I said. Multiple radios sniffing on each channel.
>
> >
> > Kismet from what I can tell tracks one BSSID, so I don't know how you would track each one as a big network.
> >
>
> There's no proof it's one big network. It may be. It may be someone spoofing a network. It may be people who haven't configured their APs correctly and all use the same SSID despite not being a common network. Kismet will *always* track per BSSID. It's up to you to consider it one logical network.
>
> >
> > EDIT: I think I understand this now and please correct me if I'm wrong.
> >
> > Say I have a laptop connected to "AP #1" on Ch. 6, but someone else is on "AP #3" on channel 11.
> >
> > Would I ever see their traffic, or strictly only my AP? I mean do multiple AP networks normally have every single AP send out the traffic in case the user moves around?
> >
> > Seems like if it didn't, it could cause a fair amount of data loss, especially if using UDP type stuff. Especially if AP #3 is trying to send the user traffic, but all of the sudden, they walked in to area only AP #1 can see them, causing AP #3 to send the data over the air where it's lost.
>
> You would never see their traffic.
>
> I say again: If you want to capture on multiple channels at the same time, you need multiple capture radios on those channels. That is the only way.
>
> -m


Reply to this message