Slightly OT: Netstumbler, high channel numbers, other weirdness

Did you not note the black helicopters ?:-} ...Jim Thompson

It's very probably a Windows system (likely a laptop).

One of the quirks of some versions of Windows, is that they can try to associate with an 802.11 "ad hoc" network, then add this network ID to their "known networks" list, and (at a later time) try to participate in this network once again. When this happens, the laptop itself is transmitting 802.11 beacon packets with the ad hoc network name in them, typically at a rate of about ten per second.

As I've heard the story - years ago, somebody set up an ad hoc network named "Free Public WiFi" somewhere. A few people with Windows laptops used it, and then walked away without switching their WiFi over to a different (infrastructure) network. The next time they powered on their systems, these systems began beaconing "Free Public WiFi", leading other people to try to associate with this "network". These people didn't get any useful connectivity... but they left *their* laptops on this setting for a while, leading still *other* people to see and try to use the "Free Public WiFi" network... and so the presence of this ad-hoc "network" has gradually spread all over the world.

This has become known as the "Windows WiFi virus", in the sense that it's "infectious" (but not overtly harmful).

Non-Windows devices might show the same behavior, if you use one to try to access the ad-hoc network of this name, and leave it running. As soon as you tell *any* device to join an 802.11 ad hoc network, it will start beaconing out that network name so that other (potential) peers can find it.

If you use a different laptop and look at the result of the network scan, you'll almost certainly see that the icon displayed for this network is different than what you see for access-point-based networks... it'll indicate that it's ad hoc (which means there's almost certainly no DHCP server, which means that you'd need to use zero-conf IP address assignment, and some sort of service discovery mechanism to figure out what's there).

See above.

First way to figure out where it is... use a Linux laptop in passive-scan mode (e.g. running Kismet), and start shutting down every Windows laptop in the area. When you shut down the right one, the beacon packets will go away. If no Windows laptop is at fault, it might be a WiFi-enabled cellphone or PDA.

Power up the errant device again, and simply switch its WiFi configuration from ad-hoc "Free Public WiFi" to your home's own WiFi network, and this should resolve the problem.

So, either you can't help him or don't care to. Isn't there a Joke group? JL is right on about you. You just post to make noise. Piss on you, JT.

I doubt it is the smart meter. In the US, many of these meters operate in the ISM bands - typically 902-928 MHz, though there are other flavors out there including yours which you state runs 2.45 GHz.

Do you have a filter on your spectrum analyzer? If not, are you reasonably comfortable you can trust the reading with an off-air antenna?

As to WLAN channel [2417], I thought "maybe" that was a UARFCN identifier. But an online calculator yields an uplink of 2.5384 GHz and downlink 2.6584 GHz, which of course, is gibberish.

In general, please see my prior posts about IT folks not knowing a whole lot...

As to "Free WiFi", my guess is you have a base station nearby, possibly on a utility pole. Should be easy enough to DF.

Yep. It's probably your own XP computah or laptop. Turn OFF ad-hoc networking and it will go away. Then update WZC (wireless zero config) and everything else on the computah:

Netstumbler has been effectively abandoned and should not be used. Better replacements are:

One that I rather like is: which runs in a browser. Java required:

Channel 2 is 2417Mhz

Someone has a Phone with WIFI enabled?

Cheers

Grow a neck beard and run kismet!

You do need to make sure your wifi adapter has monitor mode.

Actually the channels overlap, so you can't tell by frequency. Kismet gives a better view of what is happening. Being passive, it will even find stealth SSIDs.

I don't have Linux but ...

I made sure all other laptops were off. There are also no smart phones around here and our cells are off anyhow while in the house. The laptop I used will disable its WiFi function while NetStumbler is used, it just won't work during that time. Even the Windows "Find wireless networks" routine will error until you close NetStumbler.

If I do this at other locations this Free Public WiFi does not show up. Only here, so I guess I'll have to don the running shoes and approach the house from as many directions as possible. So far the signal was strongest on the side where the smart meter is. In the absence of a DF antenna (laptop has no connections for such things) it's tough because the terrain is rocky and partially very steep.

Ours transmits to the utility at 900MHz alright but has a secondary radio to rad a gas meter or something. Shouldn't be enabled becasue we don't have that. But it used to emit the occasional call near channel 3.

I trust the analyzer. Done pre-compliance jobs with that and what came back from the EMC lab was almost verbatim what I had (minus some weighting, of course). I used a short piece of wire because I only want to know what's generated right at the house.

No poles here and the laptop has no external antenna connections. The analyzer will be slow because the occasional ping on channel 3 happens irregularly. Too short for DF. NetStumbler only once listed channel 3, otherwise all nonsensical channels such as [100] and [2417], so I don't really trust it much.

Ok, but does it really mean 2? Because another "channel" it lists says [100].

Not around here.

The black ones are in the Netherlands above SkyBuck; he should be looking for GREEN ones here in the US as that is one of the ways A.Gore protects the environment (keeping things GREEN).

Very interesting!!

I get that with a winXP SP2 laptop.

It keeps seeing an ad hoc WIFI AP which is actually the SSID of a Joikuspot installation on a Nokia 700 phone but the phone has not been switched on for months...

(can't put SP3 on that laptop because it trashes its HD; it's one of the thousands of machines which SP3 totally trashed when it came out years ago).

snipped-for-privacy@coop.radagast.org (David Platt) wrote

Ahem, did you hit the "refresh network list" button? :-)

(...)

Make and model of this laptop? I've installed SP3 on various machines since its release in 2008 and have never had it trash a laptop (mostly because I do image backups before major updates so that I have a 2nd chance). The few times that SP3 failed, it was because of a 3rd party program, that was doing it's best to ruin the update. Mostly, these are the various anti-virus and anti-spyware programs. I uninstall them before proceeding.

I never had any instance nor heard of any instance where a drive "got trashed" by anything other than operator error, subsequently blamed on anything but the person pressing the buttons.

It sometimes depends on where the computer is located :-)

Yeah, that's the same problem. It's not really "seeing" the SSID, it's "remembering" the SSID from when it saw it before. It'll "remember" an ad-hoc network's SSID indefinitely.

You should be able to select this network from the list and tell it to delete (or forget) the network. This would remove the entry from the registry, and reduce the risk that your laptop will then act as a "viral" origin for this network in the future.

Absence of evidence is not evidence of absence.

It happens and I've seen it occasionally. If the Windoze installation was somewhat unstable or the registry was scrambled, installing a major update, such as XP SP3 can cause problems. Best to clean up the mess and run an image backup before updating. On particular problem that I've seen are machines that slow down and where someone decides to solve the speed problem by installing all the forgotten updates. If the speed loss was caused by a failing drive, performing the updates will usually cause a bigger problem.

What to do before installing XP SP3:

Anyway, this is too far off topic for s.e.d. I just wanted to know the maker and model of a machine that allegedly cannot update to XP SP3.