Kismet, ethereal, ipw2200: linux is great for wireless analysis

The combination Kismet-Ethereal just rules! Make sure you use the latest version of those packages as well as your drivers, especialy when you have an Intel IPW2200-based one, as there are multiple new versions released. Gentoo-users will have to enable the ~x86 keyword.

Capture your stream with kismet (very well configured by default!) and open the dump file (/tmp/Kismet-2005-07-29...dump) with ethereal and have fun. The protocol is much more implemented in the latest version of ethereal now. Management frames can be full inspected. The version of ethereal on the allready mentioned great Auditor Security Collection LiveCD is an older one and doesn't support that stuff completely.

One of the great benefits with this combination on a linux machine is that you can capture and analyse all IEEE 802.11 frames, data as well as management frames, with the full headers as they were sent on the radio. With the windows drivers and capture programs, you can only capture the data inside the data packets, no headers, no management packets. That's why expensive commercial applications like AirMagnet provide their own drivers for a small selection of cards. That's the only way they can capture the most interesting information on a windows machine. So standard (free) linux tools are just great for wireless solutions and analysis, I love it!