Antenna theory for wardriving and penetration testing

Wardriving is an activity in which a person seeks wireless access points in moving vehicles with high gain antennas mounted on the top. Usually, this access point data is correlated with GPS positions and marked on publicly accessible maps such as WiGLE. On the other hand, wireless penetration tests are focused evaluations of wireless security pertaining to an organization. In both of these cases—and any type of wireless communication—antennas play a critical role. They can mean the difference between hassle-free communication and bitter frustration. However, antenna designs and related implications are arcane topics in requirement of sincere exploration by security enthusiasts.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

The antennas in your arsenal can make or break your wardriving or wireless penetration testing efforts. Whether you are a wardriving aficionado or a wireless penetration tester, this paper is intended to help you deduce the best antenna for your requirements.

Terminology you should know

Wi-Fi operates in the 2.4 GHz radio frequency that is measured in decibels or db. In order to be able to comprehend discussions germane to the performance of antennas, you must familiarize yourself with the following terms:

dBm – dBm means decibel milliwatts. Wi-Fi network signal levels are usually measured using dBm. The negative sign is used because the transmission power is never strong enough for the signal level to be positive. For instance, to get a 0.00 dBm signal, you would need a transmission power of 0.001 watts.

• -30 dBm- Maximum possible value; you are right next to the access point (within a few feet).
• -67 dBm- Minimum requirement for timely packet delivery (e.g. for VoIP or video streaming).
• -70 dBm- Minimum requirement for reliable packet delivery (e.g. for web surfing).
• -80 dBm- Minimum requirement for maintaining a basic connection; you will experience some packet drops.
• -90 dBm- Barely able to maintain a connection; SNR is low; functionality is severely impaired.

Link Quality: Simply stated, link quality is indicative of the SNR (Signal to Noise Ratio), which is a measurement of interference versus the strength of your 'point-to-point' or 'point-to-multipoint' link. Accordingly, higher link quality will imply lower number of packet errors.

Antenna Gain: Do not be confused by this term, the antenna does not actually amplify anything. Antenna gain is a figure that reflects how efficiently your receiving antenna would convert Wi-Fi radio waves into electrical power. Antennas with a gain of 2 dBi, 5 dBi, 7dBi, 9 dBi, 13 dBi etc are available. A common mistake is to think that the one with a high dBi would be the best (e.g. 13 dBi). To understand why this is a misconception, consider the following rough sketch [Figure 1]:

Figure 1

As evident from this figure, a higher (9) dBi antenna is suitable for long horizontal ranges with the receiver and transmitter at roughly the same elevation. However, if the transmitter is placed vertically above the receiver—as in floors of a building—then a 5 dBi antenna would be your best bet. If the transmitter is at a different elevation and at a long distance from the receiver, a 7 dBi antenna would offer you the right combination of elevation and range. A 2 dBi antenna aims to cover signals equally in all directions, and is not well-suited for wireless penetration testing or wardriving.

How well do these antennas work?

The short answer is: If correctly chosen, they perform well.

The right type of antenna, with proper orientation, is able to pick up signals from miles away. However, it is imperative to point out here that many users who purchase external antennas end up being dissatisfied with their performance. The reasons for this are:

• Unrealistic expectations: This may seem obvious but these antennas are not magical devices that will pick up signals from great distances, especially when they are improperly chosen (wrong type of antenna) or have not been calibrated (aligned) well.
• Insufficient knowledge: If you are purchasing a wireless antenna, or constructing a custom one, you should be able to define your purpose and have the knowledge to choose the proper antenna that would satisfy this purpose.

To test how well an external antenna performs in contrast with a laptop's default antenna under the same conditions, we set up the following experiment. The distance between the access point and our antennas was carefully chosen so that the internal antenna could barely receive a signal at this point.

• Interfaces: 'wlan0'- internal antenna, 'wlan1'- external antenna, omnidirectional, 5 dBi
• Distance between AP and antennas: 7.62 meters or 25 feet
• Obstructions: Two concrete walls and two trees

We noticed that at this distance, using the internal antenna, we were barely able to ping the wireless router at 192.168.0.1. As evident from the roundtrip delay time of several milliseconds [Figure 2], the internal antenna was performing poorly and there were multiple packet drops.

Figure 2

At the same distance, our standard 5 dBi omidirectional external antenna was able to outperform the internal antenna, as evident by the decreased roundtrip delay time [Figure 3].

Figure 3

Let us examine the performance of both antennas in terms of link quality and signal levels. For the internal antenna, both the link quality and the signal level were extremely poor [Figure 4].

Figure 4

We were able to obtain a reliable connection using the external antenna under same conditions [Figure 5].

Figure 5

These results indicate that there is a definite performance boost when an external antenna is used—how significant this boost is would depend on the suitability of the antenna for the receiving conditions. This brings us to the next section.

Choosing the right type of antenna

There are a variety of antenna types, and each type is built with specific needs in mind. There is no "best antenna for wardriving or penetration testing". Understanding the design and purpose of each of these would help you choose the best one. An omnidirectional antenna spreads energy equally in all directions—which means shorter range. A directional antenna is able to take this same energy and focus it towards a particular direction—implying longer range in that direction.

Omni-directional antennas

This is the most common antenna type, and most if not all of you have seen one up close. For instance, the antenna on top of your car is an omnidirectional antenna. These can be used for 'point-to-multipoint' purposes such as to serve as the wireless router antenna that transmits signals to all devices in the vicinity [Figure 6]. These are not suitable to be used for point-to-point communications because transmitting signals in all directions, when you want them to go from point A to point B, is an inefficient choice.

Figure 6

• Suitability for wardriving: These are ideally suited for wardriving, since they grab signals from all directions while you are driving. However, there are some considerations: a 9 dBi omnidirectional antenna would allow you to capture far off signals from all directions, but it will miss access points in high buildings close to your vehicle. To understand why, see Figure 1. Accordingly, it is advised that you choose the correct dBi omnidirectional antenna suited for the areas you are going to drive in.
• Suitability for penetration testing: During a penetration test, you are aware of your target. Hence, a directional antenna pointed toward the target is more efficient than an omnidirectional antenna. However, you can use a 5 dBi omnidirectional antenna during perimeter testing.

Parabolic antennas

Parabolic antennas depend on a curved parabolic surface dish that focuses signals towards a central point [Figure 7]. This enables these antennas to put out incredible gains. However, parabolic antennas are highly directional, which means you need to ensure that they are pointed in the right direction, otherwise they might completely "shield" the signal. Because of their high gain, they are suitable for long range point to point communications.

Figure 7

• Suitability for wardriving: A parabolic antenna would pick up wireless signals from miles away but only from a single direction at a time. Hence, if you want to map Wi-Fi access points in multiple directions while driving, this is not the best choice.
• Suitability for penetration testing: Given their long range, parabolic antennas can be very suitable for targeted wireless intrusions, since they allow you to carry out tests from far away once you have positioned them toward target access points.

Yagi antennas

Yagi antennas, named after Dr. Hidetsugu Yagi, have a central beam with many individual elements supported by this beam [Figure 8]. These elements constitute radiators and reflectors. A variation is the 'Vagi' antenna, which is comprised of two beams side by side.

Figure 8

• Suitability for wardriving: Yagi antennas are directional, which means they are not the best choice during wardriving. They would pick up far off signals from a particular direction, while missing out on signals in the other directions.
• Suitability for penetration testing: Like parabolic antennas, Yagi antennas are capable of picking up signals from miles away. Their high gain (e.g. 25 dBi) makes them ideal for penetration testing when you have them pointed towards the target. The Vagi antenna is an attractive choice for penetration testing since they are small and lightweight, yet offer substantial gains.

Backfire antennas

Backfire antennas are known to have a small size but a significant gain. This makes them a very attractive choice for point-to-point or point-to-multipoint communications. How do they differ from parabolic antennas? There is no parabola; the reflector surface is flat. Their resonant cavity structural design makes them capable of achieving the high gain.

For suitability toward wardriving and penetration testing, see 'Parabolic Antennas'.

Building your own high gain antenna

If you have followed this discussion on antennas so far, building your own antenna can be a fun exercise. For this, you will need:

• About 1-2 inch of 12 gauge copper wire or an omnidirectional antenna
• A smooth metallic parabolic reflector such as aluminum foil, a can, an 8 inch dumpling strainer, etc.

How to make a Cantenna

Cantennas, antennas made out of cans, have been very popular among enthusiasts since they are easy to make and everything you need is in your home. The idea is to use a 'Pringles' or similar can, and introduce a copper wire near the bottom from the side of the can [Figure 9]. Calculations regarding the placement of the copper wire need to be precise. You can use this calculator to ensure accuracy.

Figure 9

However, if the can is very narrow, you would need to point this antenna very precisely towards the signal direction and even then you would not notice significant gain. Moreover, if you are using a long cable, signals would suffer attenuation.

Note: Although a Pringles can is often mentioned, it is not a good can to be used for these purposes since it is too narrow. In fact, any cantenna is a bad choice for serious penetration testing.

How to make a parabolic antenna

If you have an omnidirectional antenna available [Figure 6], the task becomes easier. Now, all you need to do is find a parabolic reflector that can "turn" this omnidirectional antenna into a parabolic antenna. This parabolic reflector can be any smooth metallic surface that can converge radio signals over the omnidirectional antenna—and this is what improves the antenna gain [Figure 10].

Figure 10

Accurate placement of the omnidirectional antenna in front of the parabolic reflector is of prime significance. There is no increase in antenna gain if an inexperienced person has placed the omnidirectional antenna too far or too close to the parabolic reflector so that it completely misses the focal point. Hence, for accuracy, use this parabolic antenna focal point calculator.

Alternatively, if you prefer to avoid making calculations, you can use freely available parabolic reflector templates which have been drawn to scale. These templates explicitly mark the focal point of the parabolic reflector so that you do not have to make calculations. For instance, you can print and use the parabolic reflector template in Figure 11. You would need a square sheet of reflective material that you can place vertically on the straight line drawn in this template, and bend the sheet until it synchronizes with the parabolic curve in the template. Notice the marked focal point (black spot) in the template; place the omnidirectional antenna at that point.

Figure 11

Note: We have discussed making parabolic reflectors; however, if you want to build a 2.4 GHz omnidirectional antenna from scratch, it can get quite convoluted. You can follow this link to build such an omnidirectional antenna.

Comparison to commercial antennas

These homemade antennas are capable of giving you results as good as commercial antennas. However, you need to be accurate while building these. Imprecise measurements, design flaws, or implementation errors would result in inefficient antennas with no significant gain.

Turning your laptop's internal antenna to an external antenna

In case you have some 5 or 7 dBi antennas from your old wireless router lying around [Figure 6], and you want to avoid purchasing a USB antenna unit, you can attach these to your laptop's built-in internal antenna unit. For this, you will need:

• U.FL male to RP-SMA pigtail cable
• Knowledge of laptop disassembly and assembly, and relevant tools
• Any 2.4 GHz antenna [Figure 6]

You would need to disassemble your laptop using required tools and locate the auxiliary antenna connector on the motherboard [Figure 12]. The U.FL side of the cable would fit into this auxiliary connector, and the other side should be fixed along the laptop's edges such that you can attach your 2.4 GHz external antenna to this SMA (SubMiniature version A) end.

Figure 12

Detriments to wireless signals

Even with the right type of antenna, you may experience weak connections characterized by frequent packet drops and delays. In these situations, one or more of these factors may be the cause:

• Distance: The most obvious reason is that you are too far from the transmitter. Signals get attenuated over long distances, especially when omnidirectional transmitters are being used, such as those used by common wireless routers.
• Weather: If an efficient transmitting antenna is being used at the right frequency, weather would have little effect on wireless signals. However, rain can absorb radio signals and enervate Wi-Fi signals at 2.4 GHz.
• Objects in path: Signals at 2.4 GHz frequency need a clear 'line-of-sight' for efficient propagation. This means that trees and walls act as obstructions to the wireless signal.
• Other access points – If there are other APs in the vicinity that are working on the same channel in crowded areas, this would cause substantial disturbance.

Conclusion

Wardriving is not illegal as long as you are aware of your limits and avoid nefarious activities such as cracking encryption, retrieving access point passwords, and accessing the Internet for free—known as Piggybacking. For wardriving, you can use a 7 dBi omnidirectional antenna placed on top of your vehicle using a magnetic-mount. For wireless penetration testing scenarios in which you want to breach the security of a particular establishment, it is best to use parabolic reflectors pointed towards the target. Depending on the conditions, these parabolic antennas would allow you carry out wireless penetration tests from a long distance which would lower the risk of being noticed by security personnel. Furthermore, using high gain directional antennas, you are able to ascertain how close to the target perimeter would the potential attackers need to be in order to intrude on wireless communications. A 5 or 7 dBi omnidirectional antenna can be used while testing premises for the presence of rogue access points.

Become a Certified Ethical Hacker, guaranteed!

Get training from anywhere to earn your Certified Ethical Hacker (CEH) Certification — backed with an Exam Pass Guarantee.

Learn More

Sources

• M. Erskine. (2002-2003)
• Tim Pozar. Late Night Software. [Online].
• R. Dean Straw, L. B. Cebik, and Dave Hallidy, Eds., ARRL Antenna Book, 22nd ed.: The American Radio Relay League, Inc., October 2011.
•  Frank Thornton Russ Rogers, "Understanding Antennas and Antenna Theory," in WarDriving and Wireless Penetration Testing.: Syngress, 2007, ch. 2, pp. 31-59.