4

Let's say I've got a 802.11n WiFi network in which all hosts are using 802.11n standard. If you start sniffing with an 802.11b/g card (using airodump for instance) will you be able to perform any malicious operation on my network?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 20:32

2 Answers 2

Reset to default
8

802.11 b/g cards can only sniff 802.11b/g traffic. They cannot see 802.11n traffic. See caveats A & B, below.

Caveat A: Many 802.11n APs are configured to allow b/g connections. Once you have an IP connection, all kinds of things are possible, including ARP cache poisoning, mac-floods, MITM attacks, etc...

EDIT for queston in the comments:

Caveat B: Even if the sender / receiver have 802.11n radios, and the attacker only has 802.11b/g, it's very possible to direct RF jamming signals towards an 802.11n sender / receiver and make them intentionally fall back to 802.11b/g data rates.

Quoting Cisco's 20 Myths of Wi-Fi interference (emphasis mine):

... non-802.11 types of interference typically don't work cooperatively with 802.11 devices, and can cause significant loss of throughput. In addition, they can cause secondary effects such as rate back-off, in which retransmissions caused by interference trick the 802.11 devices into thinking that they should use lower data rates than appropriate.

When an 802.11n PHY falls back to 802.11b/g rates, it changes the physical layer signalling from 802.11n to 802.11b/g (per-client).

Improve this answer
4
  • In the second scenario the main thing you can't do is cracking the WEP/WPA, since that requires sniffing and you don't have an IP address yet. Am I right?
    – Maurizio
    Dec 18, 2013 at 13:11
  • You don't need an IP address to sniff traffic. You put your wireless adapter into promiscuous mode which allows it to decode or record any 802.11 frame it sees. You can also spoof (use the address of a legitimate station) to create the attacks Mike mentioned. Of course, you would only do that sort of thing on your own network!
    – Ron Trunk
    Dec 18, 2013 at 20:24
  • @Ron of course you're right. What I meant to say is that when the 802.11g device joins the network (i.e. when it has an IP address) the whole network should start using* 802.11g and then it should be able to sniff all the traffic. * Maybe I'm wrong on this point. I miss lots of details, that's why I asked YLearn in a comment to his/her answer. Feel free to join the conversation.
    – Maurizio
    Dec 19, 2013 at 0:07
  • @M.D., even an unassociated 802.11b/g attacker can trick the 802.11n stations to fall back. When the 802.11n stations fall back and use 802.11b/g radio signals, you shouldn't assume that you're safe from 802.11g attackers just because the network and clients support 802.11n.
    – Mike Pennington
    Dec 19, 2013 at 0:09
6

You will not be able to capture any traffic using the high throughput (MCS) data rates. However, by default 802.11n devices will support and use legacy data rates depending on the situation.

As long as the AP and/or client are using legacy data rates, you should be able to capture their traffic. This would include most (if not all) management and control frames which will typically use a lower/legacy data rate. This is opposed to data frames which run at the best possible data rate, including the EAPOL exchange of keying material. So you will miss that unless the AP and client both use a legacy data rate for this exchange.

So in answer, yes there are many malicious operations that can be carried out on an 802.11n network by a legacy client. In particular anything that would exploit management and/or control frames, plus any data traffic that uses legacy data rates.

Improve this answer
2
  • Pretty clear answer. Let me ask you one more question: what happens when the first 802.11b/g client joins a 802.11n network? Does the whole network slow down to 802.11g or are the APs able to use the faster protocol on each connection regardless of the others? (I'm aware that's a silly question.)
    – Maurizio
    Dec 18, 2013 at 23:43
  • @M.D., no, typically 802.11n stations will communicate at 802.11n data rates, even in the presence of 802.11g stations.
    – YLearn
    Dec 19, 2013 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.