You work as a Network Administrator for Tech Perfect Inc. The company has a secure wireless network. Since the company’s wireless network is so dynamic, it requires regular auditing to maintain proper security. For this reason, you are configuring NetStumbler as a wireless auditing tool. What services can NetStumbler provide? Each correct answer represents a complete solution.
Choose all that apply.

A.
Detection of causes of wireless interference

B.
Detection of unauthorized (“rogue”) access points

C.
Capturing and decoding of packets

D.
Verification of network configurations

Explanation:
NetStumbler can be used for a variety of services:
For wardriving
To verify network configurations
To find locations with poor coverage in a WLAN
To detect causes of wireless interference
To detect unauthorized (“rogue”) access points
To aim directional antennas for long-haul WLAN links
Answer option C is incorrect. NetStumbler cannot capture and decode packets.
What is NetStumbler?
NetStumbler is a Windows-based tool that is used for the detection of wireless LANs using the IEEE 802.11a, 802.11b, and 802.11g standards. It detects wireless networks and marks their relative position with a GPS. It uses an 802.11 Probe Request that has been sent to the broadcast destination address. When NetStumbler is connected to a GPS, it records a GPS coordinate for the highest signal strength found at each access point. The main features of NetStumbler are as follows:
It displays the signal strength of a wireless network, MAC address, SISD, channel details, etc.
It is commonly used for:
a.War driving
b.Detecting unauthorized access points
c.Detecting causes of interference on a WLAN
d.WEP ICV error tracking
e.Making Graphs and Alarms on 802.11 Data, including Signal Strength How to detect NetStumbler and identify it NetStumbler uses an organizationally unique identifier (OID) of 0x00601d and a protocol identifier (PID) of 0x0001. It also uses a data payload size of 58 bytes containing a unique string that can be used to identify the version of NetStumbler. For example, Version 3.2.0 carries ‘Flurble gronk bloopit, bnip Frundletrune’, Version 3.2.3 has a payload string ‘All your 802.11b are belong to us’ , and 3.3.0 has a payload string that is intentionally left blank. Hence, with the help of these fingerprints, not only can a Network Administrator easily detect the symptoms of NetStumbler but he can also identify the version of NetStumbler being used by an attacker.