Interesting paper on monitoring an attacker's activities on a wireless network:

http://honeynet.org.es/papers/honeys...t_20071217.pdf