Wired networks
Secure(depends on physical access)
Full duplex
Max range 300 ft, more in segments w/ switches
One protocol (802.3 vs. 802.2, SNAP, Ethernet II)
Planned and installed
10/100/1000 mb/s
Collision Detection (CSMA-CD)
Switch manages traffic
OK with 802.1x and VPN
One "band"
Packet Sniffer on LAN hard w/ switch
HW address authentication possible (RADIUS)

Wireless Networks
Often insecure (physical access less restricted)
Half duplex (802.11a,b,g)
Max range 150 ft. w/ OEM, 42 miles in other cases
Several protocols: 802.11a, b, g, n
Flexible, expandable, portable
11/54 mb/s (802.11b,g)
Collision avoidance (CSMA-CA)
Hidden node problem
Channelized
Packet Sniffers very easy and hard to detect
HW address authentication possible (RADIUS)

Access Point Security Basics:
1. Change the admin password and login
2. DHCP off
3. WEP
4. closed network (no SSID)
5. Admin access on wired LAN only
6. Remote admin to non-standard port 
7. Hardware ACL lists
8. VPN
9. WPA2
10 802.1X

WEP
Good					
Easy to setup			
Good for visitors

Bad
Insecure
Easy to crack
Easy to spread/disseminate
Static keys

Closed Network (no SSID)
Good
Easy to setup
Handy for visitors
Blocks casual interlopers

Bad
Easy to subvert
Easy to proliferate

Hardware ACL
Good
No user intervention (exc. windows users)
Hard to crack
Central admin (lists, RADIUS)
Wired and Wireless security

Bad
Need to restart APs to update ACL lists (exc. RADIUS)

WPA2
Good
Easy as WEP, but more secure
WEP + TKIP means keys change constantly
HWACL + MIC means data integrity is assured
AP (personal) or RADIUS (enterprise) versions
Stops casual users and many hackers

Bad
Less secure in mixed environments (weakest link theory)

VPN
Good
Secure data connection
Stops access to the data not the network
Transparent with Panther, Tiger, Leopard
Wired and wireless use (thwarts packet sniffers)
Included with Panther/Tiger/Leopard server

Bad
Server or VPN endpoint needed

802.1X
Good
Security on steroids
Central admin (Elektron server)
Wired/wireless security solution

Bad
Certificates must be created (local or server-Elektron again)

Labs:
Network? What network?
1. Use menu bar airport monitor to look for networks: open stations only
2. Repeat with Internet Connect: Signal strength
3. Repeat with iStumbler: SNR, HW address of AP
4. Repeat with KisMac: Closed networks, tunnels, probes, HW address of clients, traffic to each client, traffic contents, packet capture/dump, packet injection, de-authentication of clients, passive or active, drivers for many cards/radios
5. Find AP with listed HW address: open/closed? SNR?
6. What else is out there?

Physical vs. Logical interference
1. Video transmission using 802.11 2.4 ghz channels (A,B,C,D)
2. Note reflection of signal, noise in transmission, blocking of signal (RF issues)
3. Note noise levels on AP traffic at certain channels using iStumbler/KisMac
4. Note antenna use on each end, types, coverage patterns, dispersion

Airport Setup:
1. Setup airport with no security, test SNR using client apps
2. Repeat using Airport Management Utility to test SNR
3. Fire up the video unit and watch what happens to the SNR on each channel
4. Activate WEP on the AP, test access from a client
5. Activate WPA2 on the AP, test access from a client
6. Activate SNMP, watch traffic using Cybergauge 
7. Activate syslog to server, watch log entries
8. Try telnet access
9. Setup PPP server
10. Monitor SNR for various clients using Airport Management Utility (AMU)

Airport lab II:
1. WDS setup: main to remote
2. Main to repeater to remote
3. Test throughput with IPNetMonitor (sustworks.com)

Packet sniffing 101: Interarchy
1. Predator machine: Join listed wireless network, then use Interarchy on  to sniff packets on http
2. On second machine (victim), login to listed webmail account, record packet traffic to/from first machine.
3. Determine login and password of email, note contents of email messages
4. Setup VPN on webmail client machine (victim) using VPN client ID and account info listed (make sure VPN option is to capture all traffic in the VPN tunnel)
5. Repeat Interarchy scan from predator machine with VPN activated on webmail client machine, note results

Packet Sniffing 202: Cracking WEP
1. Activate WEP on a Graphite Airport (airport I), record the key
2. Join the network with a client machine, streaming traffic
3. Use KisMac on a predator machine to gather IV packets
4. Use wordlist attack to break WEP

Packet Sniffing 303: Opening Closed Networks
1. Use KisMac to detect closed network. Join this network with a valid victim machine.
2. Select this channel, gather packets for later analysis
3. Show how closed network name can be gained using de-authentication of existing client (victim)

Packet Sniffing 404: Breaking HW ACL access
1. Setup any AP with HW acl list
2. Login to this AP with a valid client (victim)
3. Monitor AP with predator machine
4. Demonstrate how to record victim HW address, de-authenticate, and take over
5. Man-in-the-middle attack would be the next step

War-driving/war-walking
1. Setup KisMac in active mode, with GPS active
2. Gather data, ascertain location, download map from Expedia (zoom factor 7)
3. Walk around, noting new networks, closed/open, etc.
4. Once map is downloaded, switch to passive mode, and get tunnels, probes etc.
5. If possible, try multiple sensor scanning: internal, PCMCIA, USB
6. Upload your information to the .kismac site, look up your site for other APs

Amps and antennas:
1. Repeat war-walking with amps and antennas to detect networks miles away
2. Note coverage, dispersion pattern and sensitivity of each antenna
3. Test in both active and passive modes
4. Note amp activity lights in both modes
5. Note changes in SNR with Airport Management Utility (AMU) using amps on AP and on client
6. Using AMU, change AP power and note noise and signal level changes

Elektron Server:
1. RADIUS and 802.1X server, create certs for 802.1X
2. Setup basic HW ACL access using Elektron server
3. Setup WPA2 using Elektron Server
4. Setup 802.1X using Elektron Server

Leopard Server:
1. RADIUS from FreeRadius (see documentation)
2. Setup basic HW ACL access using Leopard server
3. Setup WPA2 using Leopard Server
4. Setup 802.1X using Leopard Server

War-Driving tools/tips/resources

Tools:
Magnetic mount antenna, 8 dB omni is best
Magnetic mount GPS receiver, Rayming TN-202/BU-353 is best
250 mW amp minimum
N type connectors to internal card on iBook, Pismo PowerBook or to Lucent PCMCIA card

Tips:
Try passive and active mode, though active mode is needed to download maps, unless you do so beforehand
Try driving past an AP in both directions, see if KisMac will locate it on the correct side of the street
Try uploading your information to the .kismac site

Resources:
KisMac
.kismac site
KisMac help documentation
References (see back)
RFLinx for amps and antennas
Rayming links

Road Warrior tools/tips/resources

Tools:
QuickerTek amps and antennas (USB powered, can be PCMCIA or internal)
KisMac to detect closed networks
VPN on OSX server (Panther, Tiger, Leopard)

Tips:
If using Boingo, T-Mobile or other vendor, always use VPN
Some of these block all but port 80 traffic. If you capture all with your VPN, you can do Timbuktu (port 407), mail, web, https (port 443), RTSP (ports 8080, 554 and 7070), just about anything you choose.
Try using this while on the plane, but not airborne, you may be surprised how much you can get
Try aiming a directional antenna (buffalo directional is very nice) at residential users, most are open if you just want to check your mail. Don't abuse this generosity, though.

Resources:
QuickerTek
KisMac
Buffalo wireless

Wireless History, via Access Points:

Precambrian Era: 802.11 (no letters), "wavelan" 1-2 mb/s, 900 mHz ISM band

3.x--Airport I ("graphite"): 802.11b, 2.4 gHz, 11 mb/s, WEP only, easy to hack into for amps, antennas etc.

4.x--Airport II ("snow"): 802.11b, 2.4 gHz, 11 mb/s, added PPP server, non-lucent proprietary card (harder to hack into)

5.x--Airport III ("extreme"): 802.11b/g, 2.4 gHz, 11/54 mb/s, added WPA, WPA2, 802.1X, USB printing, SNMP, telnet, and WDS. External antenna connector, and power adjust via software.

6.x--Airport Express: 802.11b/g, 2.4 gHz, 11/54 mb/s, integral power supply, USB printing, audio output, WDS base/client

7.x--Airport Extreme ("X2"): 802.11b/g/n, 2.4 and 5.8 gHz, 11/54/600 mb/s,  video? soon to be in iPods/iTV?