Yes -imagine the potential confrontation:

A few lines of code to parse off the first 3 bytes of the evesdropper's MAC address. Use those to look up the vendor of the WLAN card: http://standards.ieee.org/regauth/oui/oui.txt

Knowing the card and recognizing it visually could help identify the culprit. Differing signal strength from the various access points could further narrow the search down.

Walking up to him or her, posing as a fellow "war driver", enthusiastic about 'this great new network found...' -then displaying the evidence captured...imagine the shock of loosing anonymity so fast. :)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/552/15886#15886