Building a wardriving box

Reasons

I currently use a Dell Latitude C640 laptop for wardriving. The interesting part is connecting an external gps and powering it.

Over time, I used several ways of connecting a gps. The first option was the gps-usb cable. But the usb connection got interrupted on bumps which happen a lot when bicycling. When the usb connection gets interrupted the Linux usbserial driver closes the serial connection and gpsd does not reopen that connection automatically. I had weird scripts which would restart gpsd and cycle kismet.

The second option for powering a gps was a serial + keyboard connector cable. This worked for a long time until the keyboard connector broke off.

The third option was keeping the serial connection for data and fixing a cable which gets power from the usb port. This worked for a time until the usb port started coming loose from the mainboard of the laptop. Now it is flaky and sometimes most or all of a wardrive is without gps locations.

Only new networks with gps locations count at WiGLE, so I want a working gps. I could get a new laptop, but maybe I could build a dedicated box which would only do wardriving. That would also be easier to bring on car trips with my wife, she is not always charmed by me spending ten minutes in the car starting kismet and setting up the wardrive equipment before we can drive off. A box with a 'go' button which I can put in the car would work better.

Hardware

LinITX sells the PC Engines Alix.1C. When I asked them what enclosure would fit LinITX suggested the Mini-box M200 enclosure (product page at Mini-box) Mini-box M200 Enclosure (page at linitx.com), review at Mini-box M200 Enclosure review or the Mini-box M300 Enclosure for a bit more space internally. Mini-box M300 Enclosure review.

If I read the specs of the enclosure and the mainboard correctly I need to buy a 10 cm 44pin ide cable to connect the frontpanel CF reader to the internal 44 pin ide bus. LinITX link: 10 cm 44pin ide cable. I won't have to open the case to change the compact flash.
Well, the specs missed the fact that the M200 case has a normal 40 pin ide connector. Hope a 40 to 44 pin ide cable can solve this.

Also, a wireless card, the Wistron CM-9. LinITX link: Wistron CM-9 minipci 802.11abg adapter. This card has the atheros chipset for madwifi now and ath5k later with 2 u.fl connectors so I can add a female N connector and a reverse sma connector to the case with a small rubberduck type antenna for the reverse sma connector. And the N connector for the big wardriving antenna.

And a gps receiver connected to the serial port. I use the Rikaline GPS 6010-X5 I already had for wardriving.

Power

I ordered a lightweight battery (12V, 2.2 Ah, 700 grams) from Conrad with a charger. It should enable me to cycle (or drive) for at least two hours which is the usual time I stay interested in wardriving.

The whole box uses 420 mA in normal use. In theory, that would give over 5 hours of battery time. In practice the voltage will drop eventually and the power controller of the alix will cut it off. I measured 4 hours 39 minutes of active time.

Software

Kernel

Wireless network

Wired network

Sound

The Alix.1c does have audio inputs and outputs, but I'm going to use something simple: the built-in PC speaker. To control that, I use the program aptly named beep which does just that: play tones from the PC speaker at a given frequency, duration and repeat.

Building

~# debootstrap etch /root/ritchie-install

~# chroot /root/ritchie-install

src/linux-2.6.24.2# INSTALL_MOD_PATH=/root/ritchie-install make modules_install

src/madwifi-0.9.1$ make KERNELPATH=/home/koos/project/wardriverbox/src/linux-2.6.24.2

Install madwifi to the build tree:

src/madwifi-0.9.1# make install-modules KERNELPATH=/home/koos/project/wardriverbox/src/linux-2.6.24.2 \
KMODPATH=/root/ritchie-install/lib/modules/2.6.24.2/net/

Do a module dependency check with the right paths:

src/linux-2.6.24.2# depmod -b /root/ritchie-install/ -ae 2.6.24.2 \
-F ~koos/project/wardriverbox/src/linux-2.6.24.2/System.map

I installed the CF as one partition with ext3 filesystem: eventually wardriving logs will be saved to that partition so it needs all the robustness it can get.

Building version 2

src/linux-2.6.35.14# INSTALL_MOD_PATH=/home/root/dabox-install make modules_install
src/linux-2.6.35.14# chroot /home/root/dabox-install depmod -ae 2.6.35.14

Installing grub on the CF card

Installing grub 1 using the development system

$ grub
grub> root (hd3,0)
grub> setup (hd3)

Installing grub 1 as grub-legacy in the development chroot

~# debootstrap etch /home/root/tempforgrub

root@jobs:~# chroot /home/root/tempforgrub
root@jobs:/# apt-get install grub-legacy

root@jobs:/# mknod /dev/sdc b 8 32
root@jobs:/# mknod /dev/sdc1 b 8 33

root@jobs:/# grub-install --root-directory=/mnt '(hd0)'

Installing grub2 via pxebooted PLD linux

# mkdir /mnt
# mount /dev/sda1 /mnt
# grub2-install '(hd0)' --root-directory=/mnt

Menu for grub version 1

timeout 5

default 0

fallback 1

title Wardriver
kernel (hd0,0)/linux-2.6.35.14 root=/dev/ram0 ramdisk_size=55296
initrd (hd0,0)/rootimg.gz

title Wardriver Default
kernel (hd0,0)/linux-2.6.35.14 root=/dev/ram0 ramdisk_size=55296 defaults
initrd (hd0,0)/rootimg.gz

Config for grub version 2

set root=(hd0,1)
linux (hd0,1)/linux-2.6.24.2 root=/dev/ram0 ramdisk_size=55296
initrd (hd0,1)/rootimg.gz
boot

Copying the chrooted install to the rootimg

cfimage$ dd if=/dev/zero of=rootimg bs=1024k count=64
cfimage$ mke2fs -j rootimg

Copying files goes with a script which avoids copying anything to the rootimg which isn't really needed there. The whole debian adminstration is only needed on the local installation, not on the CF. The rootimg is stored compressed on the compact flash and on the local staging directory which means it has to be decompressed before any changed and compressed.

#!/bin/sh

SOURCE="/root/ritchie-install"
MNTPT="/mnt/other"
FSIMAGE="/home/koos/project/wardriverbox/cfimage/rootimg"
IMAGEDIR="/home/koos/project/wardriverbox/cfimage"

if [ -f $FSIMAGE.gz ]; then
        echo -n "Decompressing image ... "
        gzip -d $FSIMAGE.gz
        echo "done."
fi

if [ ! -f $FSIMAGE ]; then
        echo "No root image"
        exit
fi

mount -o loop $FSIMAGE $MNTPT || exit 1

rsync -avHS --progress --delete --delete-excluded --exclude=usr/share/zoneinfo --exclude=usr/share/i18n --exclude=var/lib/dpkg --exclude=var/cache --exclude=usr/share/apt --exclude=usr/share/aptitude --exclude=usr/share/locale --exclude=var/lib/apt --exclude=/root/.bash_history --exclude=var/log/dpkg.log $SOURCE/ $MNTPT/

df $MNTPT

umount $MNTPT

# yes, I actually wrote to that file ..

touch $FSIMAGE

echo -n "Compressing image ... "

gzip -9 $FSIMAGE

echo "done."

ls -l $IMAGEDIR

cfimage$ ls -l
total 18636
drwxr-xr-x 3 root root      4096 Jan 24 22:19 boot/
-rw-r--r-- 1 koos users   787919 Jan 26 20:38 linux-2.4.36
-rw-r--r-- 1 koos users 18259594 Jan 25 23:09 rootimg.gz

#!/bin/sh

FLASHPART="/dev/sdc1"
MNTPT="/mnt/other"
SOURCEDIR="/home/koos/project/wardriverbox/cfimage"

modprobe usb-storage

mount $FLASHPART $MNTPT || exit

rsync -avHS --progress --delete $SOURCEDIR/ $MNTPT/

umount $MNTPT

echo "Done syncing"

rmmod usb-storage

Inputs

Results

Pictures

Set wardriving box at flickr

Similar projects

• littledave posted about his wardriving box on the wigle forums
• Petzl posted about his wardrivebox extreme on the wigle forums .. and he has a job that pays him to drive all around Belgium picking up more networks
• church of wifi has modded a linksys wrt54g to be a wardriving box
• Wardriving.ch has built wardriving boxes from soekris and wrap systems
wardriving software which logs everything he is interested in.
• Gerd Kamp wrote about skyhook wireless location data being used in the new location application on the iPhone / iPod

Building your own?