We will assume that the wireless client has a network Wireless Lab configured on it, and it actively sends probe requests for this network, when it is not connected to any access point. In order to find the security configuration of this network, we will need to create multiple access points. For our discussion, we will assume that the client profile is an open network, WEP protected, WPA-PSK, or WPA2-PSK. This means we will have to create four access points:
To do this, we will first create four virtual interfaces—
wlan0montowlan0mon3, using theiw wlan0 interface add wlan0mon type monitorcommand multiple times adding 1 to the end of the monitor name each time:
You can view all these newly created interfaces using the
iwconfigcommand:
Now we will create the open AP on
wlan0mon:
Let's create the WEP protected AP on
wlan0mon1:
The WPA-PSK AP will be on
wlan0mon2:
WPA2-PSK AP will be on
wlan0mon3:
We can run
airodump-ngon the same channel...