"You cannot fight to win with an unequipped army."

—Mei Yaochen

When reading other books somewhat related to wireless penetration testing or just simple wardriving, the suggested hardware choice is both limited and amusing. It creates the impression that only this particular laptop brand together with that specific PCMCIA card type are useful for these aims. In reality, much depends on the hardware chosen, but there are precise technical reasons for such selection that are never listed in these sources. These reasons include client card sensitivity in dBm, client card chipset, the presence of connector sockets for an external antenna, client card power emission and consumption level, laptop/PDA battery power life and compatibility with UNIX-like operational systems, and so forth. That said, practically any wireless client card and PCMCIA/CF/SD slot-containing mobile computer can be used for wireless hacking with some additional tweaking and different grades of efficiency. This is the main message of this chapter.

PDAs Versus Laptops

The RF Basics: An Introduction to the Antenna Theory There are two main characteristics in antennas: gain (or power amplification) provided by an antenna, and beamwidth (which shapes the antenna coverage zone). In fact, it makes sense to look at the zone of coverage as a third variable, because side and back beams of some antennas are difficult to describe in terms of beamwidth. You should always demand the antenna irradiation pattern diagram from the vendor to assess the shape of the antenna irradiation (if only approximately). A future site survey will show how closely the provided diagram corresponds to the truth. We have collected diagrams from some vendors in Appendix C for your convenience as well as an aid to understanding the distinctions between different types of antennas. Another often overlooked antenna characteristic is the antenna polarization, which can easily be changed by altering the antenna position. We cover the security significance of antenna polarization in Chapter 10. An antenna's gain is estimated in dBi because it is referenced to an abstract isotropic irradiator, a fictional device that irradiates power in all directions (a star is an example of such a device). It is defined as passive because no power is injected by an antenna. Instead, the gain is reached by focusing the irradiated waves into a tighter beam. The beamwidth can be both horizontal and vertical; never lose the 3D perspective! There are three generic types of antennas that differ by irradiation pattern and beamwidth and can be further divided into subtypes. These types include: Omnidirectional antennas Mast mount omni Pillar mount omni Ground plane omni Ceiling mount omni Semidirectional antennas Patch antenna Panel antenna Sectorized antenna Yagi antenna Highly directional antennas Parabolic dish Grid antenna Omnidirectional antennas have a 360-degree horizontal coverage zone and reach gain by decreasing the vertical beam. The irradiation pattern of an omnidirectional antenna resembles a doughnut with the antenna going through the doughnut's hole. The ground plane antennas (and some ceiling mount omnidirectionals with a ground plane) prevent the irradiation from spreading downward or upward. For the magnetic mount omnidirectionals loved by wardrivers, the car serves as the ground plane. A typical use of omnidirectional antennas is providing point-to-multipoint (hub-and-spoke) links for multiple clients or even networks, using semidirectional antennas for multiple connections to a powerful central access point hooked up to an omni. Semidirectional sectorized, patch, and panel antennae form a "bubble" irradiation pattern spreading in 60 to 120 degrees in direction. They are frequently used to cover an area along a street or a long corridor; sectorized semidirectionals placed in a circle can act as a replacement for an omnidirectional, having the advantage of higher gain and vertical bandwidth (but at a higher price). Yagis form a more narrow "extended bubble" with side and back lobes. A typical use for a yagi is establishing medium-range bridging links between corporate buildings as a very cheap alternative to laying fiber where the CAT5 with its 100 m limit for 100BaseT Ethernet cannot reach. Highly directional antennas emit a narrowing cone beam capable of reaching the visible horizon and are used for long-range point-to-point links, or where a high-quality point-to-point link is required. Due to their usually high gain, directional antennas are sometimes used to blast through obstacles such as walls when no other alternative is present.

When selecting your antennas for wireless security audit, a decent omnidirectional and a high-gain, narrow-beamwidth antenna are the minimum. We usually use 12 dBi omni and 19 dBi grid directional, but you should pick the antennas that suit you best. An omnidirectional comes in handy when surveying a site, looking for rogue access points, analyzing traffic from several hosts positioned in different directions, and monitoring the area for unauthorized or suspicious traffic or interference. You should always keep in mind that with a higher gain the "doughnut" becomes flatter, and while using a higher gain omni you might not discover wireless hosts positioned below or above the coverage zone (e.g., hosts in the same building but on different floors). On the other hand, a lower gain omni might not be sufficiently sensitive to pick these hosts up. This is a possible case for using a semidirectional antenna (we use 15 dBi yagis). Alternatively, you can do a thorough scan with a narrow beamwidth directional, but remember both horizontal and vertical beamwidth planes! When it comes to the use of directional antennas, there are several obvious advantages:

• You can check how far a well-equipped cracker can position himself or herself.

• You can blast through walls and see how much data leaks through.

• It is essential for trying out jamming and certain man-in-the-middle attacks.

• It is vital for determining the attacker's position.

• Some networks can only be discovered using a decent gain directional (or semidirectional). These include the WLANs on the top floors of very tall buildings.