Hi,

Could someone help me out here, I think my network has been hacked into.  I'm planning on deploying an intrusion detection system centred around Snort and/or KisMac.  So the next time someone probes by network I will know. 

My question is whether Snort and KisMac/KisMet will alert me whenever someone tries to access my network.  Can they sniff my packets in passive mode and retrieve my passwords, or do they have to be on active sensing mode? I would like to set a trap to entice this person to so that I get alerted.

Thanks

Exige

Why spend time&effort on setting up a wireless IDS when you can improve your wireless security settings?

If your access point supports it, you should switch to WPA2 encryption (not vulnerable to attacks yet). Scan you computer for keyloggers or backdoors, review your wireless settings, update your wireless card driver and that should do it.

But, if you are willing to spend time in setting up a Wireless IDS, you can use Airsnare in order to be alerted when an unfriendly MAC address associates with your access point, but if you want to be protected for future attacks, my opinion is to use Kismet. Kismet can be set up also as an WIDS. You will be alerted when someone is wardriving near your location, if various attacks are performed (deauthentication etc.). I don't know if Airsnare has the same capabilities as Kismet does, but I am only familiar with Kismet.

The hacker can sniff your packets in passive mode, but if you are using an encryption method that's secure enough you should have no problems.

But, before doing any of the above, maybe it will be a good idea to review your AP logs, you can find out from there if someone else successfully authenticated with your AP.

Thanks, do you guys know if there is a Mac OS X download for airsnare?  If not, what other tool would be similar?

Looks like dean is right, WPA2 is also vulnerable to an off-line dictionary attack.

Last time I used aircrack-ng suite for a wireless hacking demonstration there was nothing about WPA2 dictionary attack in the aircrack-ng tutorials.

Good thing to know, thanks dean!