Unusual wifi signal

For the past several weeks, I see an unusual signal when
scanning with Kismet. It is always on the air, transmits a
single packet (reassociation request) about every 30 seconds.
Kismet shows the SSID as "<no ssid>" and the BSSID (always
the same) is 6a:6f:62:2d:73:68 ... looks bogus. Kismet
indicates this is an ad-hoc station and not encrypted.
The phantom remains when I remove power from my wireless
router, so it's not a spurious signal from my stuff. Seems
too organized and repeatable to be interference from a
cordless phone. Maybe not.

Anybody seen something like this? I'm experiencing frequent
deauthorize/disassociate flood attacks lately and I'm wondering
if there is some connection.

If it's an alien civilization trying to make contact, do I
offer milk and cookies??

"Roby" <(E-Mail Removed)> wrote in message
news:6cqdnU-_(E-Mail Removed)...
> For the past several weeks, I see an unusual signal when
> scanning with Kismet. It is always on the air, transmits a
> single packet (reassociation request) about every 30 seconds.
> Kismet shows the SSID as "<no ssid>" and the BSSID (always
> the same) is 6a:6f:62:2d:73:68 ... looks bogus. Kismet
> indicates this is an ad-hoc station and not encrypted.
> The phantom remains when I remove power from my wireless
> router, so it's not a spurious signal from my stuff. Seems
> too organized and repeatable to be interference from a
> cordless phone. Maybe not.
>
> Anybody seen something like this? I'm experiencing frequent
> deauthorize/disassociate flood attacks lately and I'm wondering
> if there is some connection.
>
> If it's an alien civilization trying to make contact, do I
> offer milk and cookies??

I like 2% and oatmeal raisin. Thanks!

alien

>> For the past several weeks, I see an unusual signal when
>> scanning with Kismet. It is always on the air, transmits a
>> single packet (reassociation request) about every 30 seconds.
>> Kismet shows the SSID as "<no ssid>" and the BSSID (always
>> the same) is 6a:6f:62:2d:73:68 ... looks bogus. Kismet
>> indicates this is an ad-hoc station and not encrypted.
>> The phantom remains when I remove power from my wireless
>> router, so it's not a spurious signal from my stuff. Seems
>> too organized and repeatable to be interference from a
>> cordless phone. Maybe not.
>>
>> Anybody seen something like this? I'm experiencing frequent
>> deauthorize/disassociate flood attacks lately and I'm wondering
>> if there is some connection.
>>

Is your computer itself a "convertible"? My gateway laptop (and tablet
convertible) does that (shows a phantom with no SSID)... I wonder if you
power off the computer also when you power off the router (course, if you
turn it off, how are ya gonna run something to check?

I also show ANOTHER one from the wireless connection on my DVR (ties my DVR
to the wireless network)... Got one of those?

Got a 2nd or a friend with a laptop?

Peter Pan wrote:

>
>>> For the past several weeks, I see an unusual signal when
>>> scanning with Kismet. It is always on the air, transmits a
>>> single packet (reassociation request) about every 30 seconds.
>>> Kismet shows the SSID as "<no ssid>" and the BSSID (always
>>> the same) is 6a:6f:62:2d:73:68 ... looks bogus. Kismet
>>> indicates this is an ad-hoc station and not encrypted.
>>> The phantom remains when I remove power from my wireless
>>> router, so it's not a spurious signal from my stuff. Seems
>>> too organized and repeatable to be interference from a
>>> cordless phone. Maybe not.
>>>
>>> Anybody seen something like this? I'm experiencing frequent
>>> deauthorize/disassociate flood attacks lately and I'm wondering
>>> if there is some connection.
>>>
>
> Is your computer itself a "convertible"? My gateway laptop (and tablet
> convertible) does that (shows a phantom with no SSID)... I wonder if you
> power off the computer also when you power off the router (course, if you
> turn it off, how are ya gonna run something to check?
>
> I also show ANOTHER one from the wireless connection on my DVR (ties my
> DVR to the wireless network)... Got one of those?
>
> Got a 2nd or a friend with a laptop?

It's a Shuttle toaster look-alike with built-in (usb) wifi. Don't know
anybody around here with a wifi client that is capable of rfmon mode ...
or of linux even! (Not seen with NetStumbler under win2k).

I think you're right about it being a phantom. The other bit of
weirdness is Kismet doesn't indicate a channel for it. I can disable
channel hopping and stil see those reassociation request packets
arrive, regardless of what channel I'm watching.

Tonight I'll truck it down to the basement (radio blackhole) and
find out what I hear there.

alien wrote:

>
> "Roby" <(E-Mail Removed)> wrote in message
> news:6cqdnU-_(E-Mail Removed)...
>> For the past several weeks, I see an unusual signal when
>> scanning with Kismet. It is always on the air, transmits a
>> single packet (reassociation request) about every 30 seconds.
>> Kismet shows the SSID as "<no ssid>" and the BSSID (always
>> the same) is 6a:6f:62:2d:73:68 ... looks bogus. Kismet
>> indicates this is an ad-hoc station and not encrypted.
>> The phantom remains when I remove power from my wireless
>> router, so it's not a spurious signal from my stuff. Seems
>> too organized and repeatable to be interference from a
>> cordless phone. Maybe not.
>>
>> Anybody seen something like this? I'm experiencing frequent
>> deauthorize/disassociate flood attacks lately and I'm wondering
>> if there is some connection.
>>
>> If it's an alien civilization trying to make contact, do I
>> offer milk and cookies??
>
> I like 2% and oatmeal raisin. Thanks!
>
> alien

Oatmeal & raisin = high fiber = good.
2% > 1% ... some improvement can be made.

On Mon, 31 Jul 2006 09:03:08 -0400 Roby <(E-Mail Removed)> wrote:

| If it's an alien civilization trying to make contact, do I
| offer milk and cookies??

Be sure it is fat free milk. We don't want to start an intergalactic war.

--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2006-07-31-(E-Mail Removed) |
|------------------------------------/-------------------------------------|