We use a Fluke Aircheck Wi-Fi tester. It's handheld easy to use and has a specific mode to graphically show power level of a client. It works well. Pretty easy to discreet but it does have Flukes bright yellow case.
Kevin Grover Utah State University From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:[email protected]] On Behalf Of Alexandra Frincu Sent: Thursday, March 14, 2013 6:22 AM To: [email protected] Subject: [WIRELESS-LAN] locating stolen laptop - wireless campus network Hello, In a wireless campus network, it happens that stolen devices reappear. This subject has been already addressed on Educause in 2008: http://listserv.educause.edu/cgi-bin/wa.exe?A2=ind0812&L=WIRELESS-LAN&T=0&F=&S=&P=37407 and in 2010: http://seclists.org/educause/2010/q3/176 I am wondering if progress was made on this topic in the last years. In particular, I wonder how to precisely locate a stolen device, after you get the alert that its MAC address is detected on the network (the laptop appears associated to a specific AP in a specific building). How can you pinpoint that device? One option, is to walk around with a laptop and an AirPcap card, sniffing the traffic, filtering on that certain MAC address and when the RSSI gets higher it means you are closer to that stolen laptop. However, this is not that discreet and there's always the risk that before being able to pinpoint the laptop, the fake owner will leave. Another option is to use tcpdump on a laptop, and filter the raw packets from that MAC address and constantly monitoring its signal level until the best value is found. Airodump, which shows the traffic on all channels is also an alternative. Is there a complex and more user friendly tool that is being used in your campus? ideally, a tool simple enough so it could be used by the security staff (the persons entitled to catch the thief) on a tablet or smartphone? Any experience/thought/recommendation on this subject would be highly appreciated. Best regards, Alex ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
