GO KALI FREE
AdvancedWireless Security

Wireless Reconnaissance: Discovering WiFi Networks

Learn wireless reconnaissance techniques including network discovery, client enumeration, hidden SSID detection, signal mapping, and WiFi monitoring for security assessment.

#Wireless Reconnaissance#WiFi Discovery#Kismet#airodump-ng#Signal Analysis

Mapping the Airwaves

Wireless reconnaissance is the systematic process of discovering, identifying, and mapping wireless networks and associated devices. It is the foundational phase of any wireless security assessment, providing the intelligence architecture for subsequent testing. Unlike wired network recon, wireless recon requires physical proximity and understanding of radio frequency behavior.

Prerequisites

  • **WiFi Security Basics** — 802.11 standards and frame types
  • **Wireless Adapter** — Monitor mode capable hardware

    • Wireless Reconnaissance Methodology

    Phase 1: Preparation

    # Verify hardware capabilities
iw list | grep -A 10 "Supported interface modes"

# Enable monitor mode
airmon-ng start wlan0

# Scan for channels
airodump-ng wlan0mon

    Phase 2: Network Discovery

    # Extended scan
airodump-ng -w recon_data wlan0mon

# Target specific bands
airodump-ng --band abg wlan0mon

    Reveals BSSID, channel, signal, encryption, SSID, and client count.

    Phase 3: Client Enumeration

    # Capture specific AP traffic
airodump-ng --bssid AP_MAC -c CHANNEL wlan0mon

# Probe request monitoring
airodump-ng --probes wlan0mon

    Client information reveals device types, probe requests, signal strength, and activity patterns.

    Using Kismet for Advanced Recon

    Kismet provides multichannel scanning, hidden SSID detection, client tracking, and manufacturer identification:

    kismet
kismet_server --override-wifi-source wlan0mon

    Hidden SSID Detection

    Networks configured to hide their SSID still transmit it in probe responses and association frames:

    airodump-ng --bssid AP_MAC -c CHANNEL wlan0mon
aireplay-ng -0 1 -a AP_MAC -c CLIENT_MAC wlan0mon
# Reconnection reveals SSID in association frames

    Signal Mapping

    Signal strength (dBm) indicates distance:

  • `-30 dBm` — Excellent (few meters)
  • `-50 dBm` — Good (within a room)
  • `-67 dBm` — Fair (same floor)
  • `-85 dBm` — Marginal (barely connected)

    • Rogue AP Detection

    # Look for duplicate SSIDs with different BSSIDs
airodump-ng wlan0mon | grep "TargetSSID"

# Monitor for deauth floods
tcpdump -i wlan0mon -n -e type mgt subtype deauth

    Common Mistakes

  • Scanning from a single location (signal varies dramatically)
  • Ignoring the 5GHz band
  • Not checking for WPS
  • Missing transient networks

    • Best Practices

  • Scan from **multiple physical locations**
  • Scan **multiple bands** (2.4GHz, 5GHz, 6GHz)
  • Document findings with timestamps and locations
  • Use **both active and passive modes**
  • Maintain a **baseline** for anomaly detection

    • Related Tools

  • **Kismet** — Advanced detector and IDS
  • **airodump-ng** — Packet capture and discovery
  • **WigleWifi** — War driving mapping
  • **Wireshark** — Deep packet analysis

    • Related Articles

  • Aircrack-ng Guide: Complete Wireless Security Assessment
  • WiFi Security Basics: Protecting Wireless Networks
  • WPA2 Explained: Security Protocols and Vulnerabilities
  • Evil Twin Attacks: Rogue Access Point Threats and Detection

    • Summary

    Wireless reconnaissance is the essential first step in wireless security assessment. Using airodump-ng and Kismet, professionals discover networks, enumerate clients, detect hidden SSIDs, and map signal coverage. Physical recon elements provide spatial context beyond pure technical scanning.

    Knowledge Check

  • Why is physical location important in wireless recon?
  • How can hidden SSIDs be discovered?
  • What extra capabilities does Kismet provide over airodump-ng?
  • What does signal strength indicate about AP location?

    • Frequently Asked Questions

    What is wireless reconnaissance?

    Wireless reconnaissance is the process of discovering, identifying, and mapping wireless networks and associated devices. It is the first phase of any wireless security assessment, providing foundational intelligence for subsequent attacks like handshake capture or evil twin deployment.

    Why is physical location important in wireless recon?

    WiFi signals degrade with distance and obstacles. Scanning from a single location misses networks outside your range. Multiple physical positions provide complete coverage of the target area and reveal signal strength variations that indicate AP proximity.

    How can hidden SSIDs be discovered?

    Hidden SSIDs still appear in probe responses and association frames when clients reconnect. By capturing traffic during client reassociation or sending directed probe requests, the SSID is revealed in clear text despite being excluded from beacon frames.

    What extra capabilities does Kismet provide over airodump-ng?

    Kismet offers multichannel scanning without channel hopping, passive hidden SSID detection, client tracking across channels, manufacturer identification via OUI lookup, and built-in alerting for new networks or suspicious activity — capabilities beyond airodump-ng's single-channel focus.

    What does signal strength (dBm) indicate about AP location?

    Signal strength in dBm correlates with distance: -30 dBm is excellent (nearby), -50 dBm is good (same room), -67 dBm is fair (same floor), and -85 dBm is marginal (barely connected). Mapping signal strength across locations triangulates AP position.

    What is the difference between active and passive wireless scanning?

    Passive scanning listens for beacon frames broadcast by APs, providing a complete picture without generating traffic. Active scanning sends probe requests, which is faster but generates detectable wireless traffic that may alert monitoring systems.

    How do you detect rogue access points during recon?

    Look for duplicate SSIDs with different BSSIDs, which may indicate evil twin attacks. Monitor for deauthentication floods that suggest active attacks. Compare observed networks against the authorized AP inventory to identify unauthorized devices.

    Why should you scan multiple WiFi bands during reconnaissance?

    2.4GHz, 5GHz, and 6GHz bands have different ranges and penetration characteristics. Organizations may use different bands for different purposes. Scanning only 2.4GHz misses 5GHz networks that may have weaker security configurations or different client populations.

    What is probe request monitoring and why is it useful?

    Probe requests are frames sent by devices seeking known networks. Monitoring them reveals which WiFi networks devices have previously connected to, enabling targeted evil twin attacks against specific SSIDs that clients are actively seeking.

    How does airodump-ng display network information?

    airodump-ng shows BSSID (AP MAC), channel, signal strength (dBm), encryption type (WPA2, WPA3, OPN), SSID name, and connected client count. This information guides target selection for subsequent wireless attacks.

    What role does WigleWifi play in wireless recon?

    WigleWifi is a war-driving database that maps worldwide WiFi networks. It provides historical data about networks in an area, helping assessors understand the wireless landscape before on-site reconnaissance and identify networks of interest.

    How long should wireless reconnaissance take for a typical assessment?

    Duration depends on scope. A basic assessment may require 30 minutes of scanning. Comprehensive recon with multiple locations, band coverage, and client enumeration can take several hours. Extended monitoring over multiple days captures transient networks and usage patterns.