Wireless packets being sent when no connection?

Hi all,
I was just wondering, I'm running type 802.11G only connection between my 2
pc. Mine is on wired and my girlfriends is wireless. I was wondering, how
come if my girlfriend's pc is off for 2-3 days can there be packets sent
from the wireless router? According to my routers log, there is no packets
received, only sent. Can be in the 10000 even saw 30000. Is that normal?
what's happening in fact?
Thanks all
Frank
oh and also, between 128bits WEP and WPA passphrase, which is better?

"Frank" <(E-Mail Removed)> wrote in message
news:8TEJc.12412$(E-Mail Removed)...
> Hi all,
> I was just wondering, I'm running type 802.11G only connection between my
2
> pc. Mine is on wired and my girlfriends is wireless. I was wondering, how
> come if my girlfriend's pc is off for 2-3 days can there be packets sent
> from the wireless router? According to my routers log, there is no packets
> received, only sent. Can be in the 10000 even saw 30000. Is that normal?
> what's happening in fact?

The access point send out Beacon frames 10 times per second just to let the
world know that the WLAN is there.

> Thanks all
> Frank
> oh and also, between 128bits WEP and WPA passphrase, which is better?

128 bits is the key (actually Initialization Vector and Key) length, not the
length of a passphrase. A passphrase is only a convenience that lets you
specify a text string, from which fixed-length keys are derived. WPA is
superior to WEP.

Ron Bandes, CCNP, CTT+, etc.

On Thu, 15 Jul 2004 19:59:03 -0400, "Frank" <(E-Mail Removed)>
wrote:

>I was just wondering, I'm running type 802.11G only connection between my 2
>pc. Mine is on wired and my girlfriends is wireless. I was wondering, how
>come if my girlfriend's pc is off for 2-3 days can there be packets sent
>from the wireless router? According to my routers log, there is no packets
>received, only sent. Can be in the 10000 even saw 30000. Is that normal?

30,000 packets of 64 average byte size packets, would be approximately
2Mbytes of traffic. This is far more traffic than I would expect from
a pair of idle radios. In addition, the unspecified router logs do
not include management frames (flow control, key renewals, SSID
broadcasts, etc). The 2MBytes is real traffic.

Your ladyfriend computah may be turned off but yours is apparently
running. I guess(tm) you have picked up a worm or trojan horse, and
it is sniffing around with ICMP packets looking for another machine to
infect. That's the nature of such probes which do not require an
unsuccessful response. Start with a virus scan followed by a scan for
Spyware (I use Spybot S&D 1.3). Do it on both machines.

>oh and also, between 128bits WEP and WPA passphrase, which is better?

Use WPA-PSK (shared key) instead of WEP. It's more secure.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558

Thanks for the info. Well my pc is virus free, spyware free, ports are all
blocked. I've done tests and nothing came up. So I guess Ron Bandes info is
good. My wireless router would be sending packets every now and then to show
it's presence. I never have any packets received, only trasmitted packets.
anyhow, thaks all.


Jeff Liebermann" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Thu, 15 Jul 2004 19:59:03 -0400, "Frank" <(E-Mail Removed)>
> wrote:
>
> >I was just wondering, I'm running type 802.11G only connection between my
2
> >pc. Mine is on wired and my girlfriends is wireless. I was wondering, how
> >come if my girlfriend's pc is off for 2-3 days can there be packets sent
> >from the wireless router? According to my routers log, there is no
packets
> >received, only sent. Can be in the 10000 even saw 30000. Is that normal?
>
> 30,000 packets of 64 average byte size packets, would be approximately
> 2Mbytes of traffic. This is far more traffic than I would expect from
> a pair of idle radios. In addition, the unspecified router logs do
> not include management frames (flow control, key renewals, SSID
> broadcasts, etc). The 2MBytes is real traffic.
>
> Your ladyfriend computah may be turned off but yours is apparently
> running. I guess(tm) you have picked up a worm or trojan horse, and
> it is sniffing around with ICMP packets looking for another machine to
> infect. That's the nature of such probes which do not require an
> unsuccessful response. Start with a virus scan followed by a scan for
> Spyware (I use Spybot S&D 1.3). Do it on both machines.
>
> >oh and also, between 128bits WEP and WPA passphrase, which is better?
>
> Use WPA-PSK (shared key) instead of WEP. It's more secure.
>
>
> --
> Jeff Liebermann (E-Mail Removed)
> 150 Felker St #D http://www.LearnByDestroying.com
> Santa Cruz CA 95060 AE6KS 831-336-2558

On Sat, 17 Jul 2004 10:33:40 -0400, "Frank" <(E-Mail Removed)>
wrote:

>Thanks for the info. Well my pc is virus free, spyware free, ports are all
>blocked. I've done tests and nothing came up. So I guess Ron Bandes info is
>good. My wireless router would be sending packets every now and then to show
>it's presence. I never have any packets received, only trasmitted packets.
>anyhow, thaks all.

Well, we're both wrong.

The SSID beacon broadcasts are usually 10 per second. (They're
adjustable on my BEFWS4 to anything between 1-65,000 msec.) If that's
what you were receiving, you would get:
10 packets/sec * 3600 sec/hr * 24 hrs/day * 3 days
= 2.6 million packets
which is somewhat in excess of the 30,000 packets your unspecified
router logs offered. I don't think that there was any counter wrap or
you would have noticed it.

Like I said, the router traffic counters do not count management
frames and flow control frames. Incidentally, I threw in the
"unspecified" as a subtle into to kindly disclose the router model.
Different software houses have different ideas of what constitutes a
packet and I'm curious.

Working the other direction, 30,000 packets in 3 days works out to:
30,000 packets / (3 days) / (24 hrs/day) / (60 min/hr)
= 7 packets per min

Well, I guess I'm also wrong. One packet every 8.5 seconds isn't
really not enough traffic for the typical worm or virus, which spews
far more traffic. However, that roughly fits the pattern for NETBIOS
broadcasts (every 30 seconds), WINS announcements (every 30 seconds),
IPX SAP announcements (every 60 seconds), and router RIP broadcasts
(every 60 seconds).

If you wanna be sure, download and install the latest version of
Ethereal:
http://www.ethereal.com
and sniff the traffic.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 AE6KS 831-336-2558