Site Survey Considerations and Planning

Warwalking has some obvious disadvantages: You have to carry all your equipment around (antennas present the largest problem) and have power limited to the battery power of your laptop or PDA and the amount of spare batteries you can carry. It is unlikely you can take a very high-gain directional antenna or an amplifier on a warwalking trip. Most important, a warwalker and his or her equipment are exposed to the adverse effects of the elements. Laptops do not really enjoy rain, and wet RF connectors mean a significant loss that might persist afterward due to rusting.

Wardriving, on the contrary, provides good protection against the elements and a good source of power in the form of a car battery and a generator. You can discover all networks in the area, and it doesn't matter how fast you drive: The beacon frames are sent every 10 milliseconds and you won't miss one while passing by or through the WLAN. Of course, you won't dump a lot of traffic unless you drive really slowly and will have difficulties in observing and analyzing the packets in the air and launching various attacks unless you can park in the appropriate place. This is often impossible in the center of a large city or on a private corporate premises. Another obvious problem when wardriving is the antenna. You'll need to place an external antenna outside of the car to avoid a significant loss caused by the car frame. Remember that even a normal glass brings around 2 dBm of loss. Of course, placement of an external antenna would mean an RF cable with connectors, which brings more loss. Typical wardriver kits or "rigs" include a magnetic-mount, ground plane, omnidirectional antenna with about 5 dBi gain and a thin pigtail-style cable that might cause more loss than the gain produced by the little omnidirectional on the top of the car. Mounting anything better on your car roof would present an additional technical challenge and you won't be able to use high-gain directional antennas unless you wardrive in a convertible. Thus, an appropriate combination of wardriving and warwalking is usually required.

A high place from which to search and connect might be a tall building roof, top of a hill, or a room on the top floor of an appropriately placed hotel where a determined wireless attacker could stay for a day or two to get into the target corporate wireless network. The advantages of warclimbing are derived from the stationary position of an attacker and the distance and link quality obtained by using a high-directional antenna and having a clear line of sight (LoS). Of course, appropriate warclimbing sites have to be present and the best site found by checking the signal strength of a targeted network. In terms of penetration testing, finding all such sites in the area and being aware of their positions beforehand can be a great help should one ever need to triangulate and find an advanced attacker armed with a high-gain directional antenna and confident of his or her invincibility, like Boris in Golden Eye.

We do not cover more exotic methods of enumerating wireless networks such as warflying. As someone pointed out at Slashdot, "How do you chalk from 12,000 feet high?" Surely the networks could be discovered, but if you manage to log a single data packet, consider yourself lucky. Nevertheless, we are planning a trip in a hot air balloon with a decent directional antenna, a hybrid of warclimbing and warcycling, perhaps.

When planning your site survey and further penetration testing, take into account the things you might already know from the data-gathering phase; for example, the area landscape and network positioning: