I haven't really gotten into it very deep yet but it is kinda fun...a little tough to keep the ol' eyes on the road at times, though...I'll probably get me some kismet goodness...although GPS is out of my financial reach for the moment. (the 770 itself was a stretch for one of my "on a whim" purchases.)

SECOND that

Right now i have been using netstumbler, but its slightly inconvenient to tote around a laptop for it. i dont have a compatible ppc for the job but i do have my 770. i have multiple branches/locations that must be sanned for APs. i want to use kismet as described in the article i referenced earlier and then plot the signals based on their gps readings. basically, i want to be able to write my report as definitively being able to assure that there are no APs on company property.

And if i can't identify them based off of location, i _could_ have probable cause to believe that our network might be @ risk and then decode any encrypton (if necessary) to connect to them - to prove that they are attatched to our network.

Im just looking for other known methods.

What is the info you need? You want to find non-secured APs or both secure/non-secure? Do you want to find both broadcasting and hidden SSIDs?

another thing about kismet is that you will only get the GPS coordinates of where you were when the AP was first found. it is not really a definitive means of plotting your target wireless networks range. you may have to break out the laptop and use netstumbler to get SNR readings to truely define the coverage radius.

Exactly! I can plot the detection of each AP and then show its signal strength based on location. Basically triangulate the location of each AP to prove that it isn't physically located near the network.

This is only one step of the project that I am working on, but my evil overlords, er, I mean employers have high expectations for a comprehensive report.

Thank you guys for the comments!

Jeffus - the info I am looking for is AP detection, what encryption it uses, physical location (best possible), and risk assessment. I need to hunt down any & all APs near the company's locations.