Multi-channel Wardriving Tools for IEEE 802.15.4 and Beyond

Wireless standards that divide their frequency band into channels pose a fundamental challenge to wardrivers: what frequency is the target on? The traditional approach is to scan the spectrum, either actively or passively, to try to discover unknown wireless networks while passing them. Single-frequency scans carry the risk of not finding networks or being foiled by frequency hopping strategies. The wardriving of tomorrow should mitigate these risks with ""full-take"" spectrum captures that eavesdrop on every channel simultaneously. IEEE 802.15.4 is a simple wireless protocol that has 16 channels in the unlicensed 2.4 GHz band, and is gaining traction in the IoT world. Many hacking tools like KillerBee and Api-Mote have been developed for it, which rely on scanning to find new networks. Recent approaches to multi-channel 802.15.4 sniffing use either software defined radio or a cluster of existing sniffers. These approaches can be expensive, clunky, and sometimes do not cover every channel. We promote a third, hardware based approach based on multiple radio transceivers embedded into a single device. This talk features a short analysis of IEEE 802.15.4 sniffing technologies and presents a new design for a multi-channel sniffer.