inflight wifi: some network analysis

I am on a plane with wifi. Naturally, I'm trying to explore the network. Here's some raw data. Sorry for the massiveness of it.

Internet provided (for $5/flight) by:

http://www.gogoinflight.com/gogo/splash.do

Screenshot of speedtest: http://picasaweb.google.com/wordymusic/InAirWifi#5521697470990105234

Ideas on things to try (I didn't get to all of them.)

• traceroute to various places, try to figure out if you're behind some sort of transparent proxy, mainly by trying encrypted connections and odd ports.
• nmap the entire subnet to see if there's any other interesting equipment, do indepth probe scans on anything interesting.
• packet sniff the entire plane with kismet.
• see if it asks you to reauth if you steal somebody else's ip address.
• try arp poisoning to make sure you get it

Fast pinger version 2.20

(c) Wouter Dhondt (http://www.kwakkelflap.com)
Pinging 12.130.117.106 with 32 bytes of data every 15 ms:
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
12.130.117.106: request timed out
Ping statistics for 12.130.117.106:
Packets: Sent = 10, Received = 0, Lost = 10 (100% loss)
Approximate round trip times in milli-seconds:
Minimum = 0.0 ms, Maximum = 0.0 ms, Average = 0.0 ms

http://www.maxnoc.com/support/looking_glass.html

12.130.117.106 is from United States(US) in region North America

TraceRoute to 12.130.117.106

Hop

(ms)

(ms)

(ms)

IP Address

Host name

1

48

46

35

72.249.128.105

-

2

22

27

43

206.123.64.22

-

3

25

59

45

216.52.189.9

border4.te4-4.colo4dallas-5.ext1.dal.pnap.net

4

21

22

27

216.52.191.33

core2.tge5-1-bbnet1.ext1.dal.pnap.net

5

10

13

18

65.208.15.229

0.ge-0-1-0.gw3.dfw13.alter.net

6

9

17

9

152.63.101.53

0.ge-3-0-0.xl3.dfw7.alter.net

7

8

6

6

152.63.96.45

0.ae3.br1.dfw13.alter.net

8

11

16

9

192.205.36.213

-

9

38

30

38

12.122.195.238

cr1.dlstx.ip.att.net

10

39

35

29

12.122.28.86

cr2.kc9mo.ip.att.net

11

34

64

44

12.122.28.90

cr2.sl9mo.ip.att.net

12

37

38

52

12.122.2.21

cr2.cgcil.ip.att.net

13

66

38

30

12.123.7.249

cr84.cgcil.ip.att.net

14

90

49

45

12.122.132.161

gar8.cgcil.ip.att.net

15

62

71

70

12.122.254.18

mdf001c7613r0001-gig-10-1.chi2.attens.net

16

34

36

32

12.130.96.174

mdf001c7613r0004-gig-12-1.chi2.attens.net

17

46

58

49

12.130.100.142

-

18

60

69

55

12.130.115.249

-

19

Timed out

Timed out

Timed out

-

20

Timed out

Timed out

Timed out

-

21

Timed out

Timed out

Timed out

-

Your IP Address Is: 12.130.117.106

Possible Proxy Detected: 1.0 10.240.20.13:8080 (squid/2.6.STABLE12)

geeklinda@cyberpunk-geeklinda:~$ traceroute 12.130.117.106

traceroute to 12.130.117.106 (12.130.117.106), 30 hops max, 60 byte packets

1 172.19.131.2 (172.19.131.2) 1.129 ms 1.162 ms 1.433 ms

2 * * *

3 * * *

4 * * *

5 * * *

6 * * *

7 * * *

8 * * *

9 * * *

10 * * *

11 * * *

12 * * *

13 * * *

14 * * *

15 * * *

16 * * *

17 * * *

18 * * *

19 * * *

20 * * *

21 * * *

22 * * *

23 * * *

24 * * *

25 * * *

26 * * *

27 * * *

28 * * *

29 * * *

30 * * *

geeklinda@cyberpunk-geeklinda:~$ nmap 12.130.117.106

Starting Nmap 5.00 ( http://nmap.org ) at 2010-09-27 16:22 CDT

Interesting ports on 12.130.117.106:

Not shown: 997 filtered ports

PORT STATE SERVICE

80/tcp open http

82/tcp open xfer

8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 7.38 seconds

geeklinda@cyberpunk-geeklinda:~$ nmap 12.130.117.106 -p0-5000

Starting Nmap 5.00 ( http://nmap.org ) at 2010-09-27 16:23 CDT

Interesting ports on 12.130.117.106:

Not shown: 5000 filtered ports

PORT STATE SERVICE

80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 15.70 seconds

Your IP address is:

Overwhelmed with spam? Protect your contact forms

Your Proxy IP: 12.130.117.106 Browser : Chrome 6.0.472.53 OS : Ubuntu Linux 10.04

	Delay	Host		Delay ( ms )				Success Rate
	Packet Loss			min	avg	max
1		svcacis-04-ge30.conxion.net 206.204.4.1		0.274	0.327	0.378		3 /	3	100%
2		ge2-1-brc2-sjca.us.conxion.net 206.204.250.145		0.306	0.331	0.345		3 /	3	100%
3		so-0-3-2-brj1-paca.us.conxion.net 206.204.250.25		1.232	1.235	1.239		3 /	3	100%
4		ge-6-9.car1.SanJose2.Level3.net 65.57.244.13		1.264	1.283	1.313		3 /	3	100%
5		ae-33-89.car3.SanJose1.Level3.net 4.68.18.133		2.172	2.285	2.395		3 /	3	100%
6		level3-gw.sffca.ip.att.net 192.205.33.81		4.178	4.221	4.257		3 /	3	100%
7		cr1.sffca.ip.att.net 12.122.137.18		54.245	70.505	87.754		3 /	3	100%
8		No name for this address 12.122.4.122		53.625	53.773	54.005		3 /	3	100%
9		No name for this address 12.123.7.109		53.023	53.290	53.507		3 /	3	100%
10		No name for this address 12.122.133.157		52.967	53.010	53.043		3 /	3	100%
11		mdf001c7613r0001-gig-10-1.chi2.attens.net 12.122.254.18		53.757	53.812	53.874		3 /	3	100%
12		mdf001c7613r0003-gig-10-1.chi2.attens.net 12.130.96.170		53.814	53.872	53.942		3 /	3	100%
13		No name for this address 12.130.100.142		53.659	53.675	53.706		3 /	3	100%
14		No name for this address 12.130.115.245		53.791	53.799	53.812		3 /	3	100%
15		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
16		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
17		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
18		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
19		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%
20		NO RESPONSE		0.000	0.000	0.000		0 /	3	0%

Trace from

What I've learned: have a plan for analyzing a network! Don't just do it "on the fly" especially if you're only going to be in the air for two hours, and only allowed to have electronics on for ~half of that! (I spent some time googling... and installing...)

Evil wifi

Rocking blog post on evil wifi and how to defend against it is here. http://www.h-i-r.net/2010/09/evil-wifi-subversive-wireless-self.html