airodump-ng mon0

[AC130]

Hi,

I have a question re airodump.

If I run "airodump mon0" and see all the access points and clients does anyone know I'm there?

I have no desire to cause any trouble, my town is too small for that but can the act of running that command alert me to say a university admin?

I know that if I do arpreplay that will cause a lot of traffic but when I run airodump am I just picking up whats already out there without drawing any attention to myself?

Thanks,

[lupin]

Depends if anyone sees you sitting in the car with your antenna pointing at them or not. If you have spent any amount of time reading posts here you would realise that this question might get people suspicious. Let me say that you are really better off not doing any sniffing of anything that doesn't belong to you, and we won't tolerate discussions of that here.

I will say that airodump-ng is designed as a passive sniffer, if that helps. If you want to confirm its not going to "leak" then you would need to test it, but if you're not doing anything wrong you probably don't need to worry about that.

[kill_box001]

airodump-ng is passive analysis tool and it is just listening to the wireless transmissions, the only way to be discovered would require detecting cards in promiscuous mode (monitor mode), yet i dont know how this would be achieved.

aireplay-ng is an active tool as it injects and modifies data in order to deauthenticate etc etc

however the developer for pyrit made this post on his blog caliming he found a vunerablility in some versions of the aircrack-ng suite which allowed him to set up a honetpot network and crash a session of airodump-ng etc; i will let you read the rest, either way

Aircrack-ng still vulnerable / honeypot

[AC130]

Thanks, that's what i thought but after I stopped using airodump I saw a two access points from my regular laptop saying assip_scanning 1 and 2.
I didn't use airplay or anything like that so was surprised that what I was doing was drawing any attention to myself. Perhaps those two aps are always there and I just noticed them yesterday, I don't know?
Anyway thanks,