Wireshark Filters

Filter by BSSID and filter out mgt frames

(wlan.bssid == 00:1B:11:55:2D:97) and (wlan.fc.type_subtype != 0x08)

Kismet Drone on WRT54G (v3) and OpenWRT

I will probably be updating this over time.

Great reference....
http://www.renderlab.net/projects/wrt54g/openwrt.html


- If you get the error "bind(): network is down", perform these steps
1. nvram set lan_ifnames="eth1 eth2 eth3 vlan0"
2. nvram commit
3. reboot; exit

- In the kismet_drone.conf file, the device should be: "source=wrt54g,eth1:prism0,wrt54g"

How to un-brick a WRT54GL (with OpenWRT)

1. Boot router into failsafe mode. What you need to do here is to change the IP of a working machine to 192.168.1.2 (because in failsafe, the router will default to 192.168.1.1) and make sure that it is on the same network as the router.

2. Either download and run the recvudp program (http://downloads.openwrt.org/people/florian/recvudp/) or run "tcpdump -ni eth0 port 4919 and udp". The reason for this is that, right after a hard reset, there will be a very brief period of time where a UDP message will be broadcast from the router on the 192.168.1.0/24 network. Once you see the 'Press now to reset' message, press and hold the reset button on the back for 2 seconds. Another message should be broadcast saying that it is booting into failsafe. Also, apparently, the DMZ light on the front is an indicator as well.
NOTE: YOU NEED TO BE USING ONE OF THE LAN INTERFACES ON THE ROUTER FOR THIS STEP.

3. Wait a few moments. You should now be able to telnet 192.168.1.1 without a password.

4. Do what you gotta do. If you've screwed up your filesystem, run the firstboot command to re-initialize it and then do a hard reset.

NOTE: IF YOU NEVER ENABLED BOOT-WAIT IN THE NVRAM, DO SO NOW!!!!! THIS WILL ALLOW YOU TO TFTP A NEW IMAGE LATER IF NEED BE.

NOTE: ALTHOUGH YOUR NVRAM SETTINGS WILL REMAIN AS THEY WERE, YOUR FIREWALL WILL BE RE-INITIALIZED. TO FURTHER CONFIGURE YOUR MACHINE, IT IS EASIEST TO DO SO THROUGH ONE OF THE LAN PORTS AND NOT THE WAN PORT SINCE IT IS BLOCKED BY DEFAULT.

Tweaking a newly-flashed OpenWRT firewall

The goal here is to make the system as transparent to a network scan as possible (ie. GRC's Shield's Up).

1. Replace...

iptables -A INPUT -p icmp -j ACCEPT

...with...

iptables -A INPUT -p icmp -j DROP

2. Replace...

iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

...with...

iptables -A INPUT -p tcp -j DROP
iptables -A INPUT -j DROP

100+ web development resources

http://blog-well.com/2008/03/04/100-resources-for-web-developers/