Skip to content
HackIndex logo

HackIndex

Detecting Open Wireless Networks

2 min read Mar 17, 2026

Open wireless networks transmit all data in plaintext. Any adapter in monitor mode on the same channel can read every frame without credentials or decryption. This includes HTTP traffic, DNS queries, unencrypted application data, and any credentials sent without TLS. The absence of encryption is confirmed from the beacon before connecting to anything.

Identify Open Networks with airodump-ng

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 BSSID              PWR  Beacons  CH   MB   ENC   CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -48       92   6   54   OPN                     FreeWifi
 11:22:33:44:55:66  -55       61  11  130   OPN                     CafeGuest
 77:88:99:AA:BB:CC  -72       14   6  130   WPA2  CCMP    PSK       HomeNetwork

OPN in the ENC column confirms no encryption. The CIPHER and AUTH columns are blank for open networks. Any network showing OPN is transmitting all data in plaintext and is readable by passive capture with no further steps required.

Confirm with iw

Verify the absence of any RSN or WPA information elements in the beacon:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 20 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|RSN|WPA|Privacy" 
SSID: FreeWifi

No RSN or WPA information elements in the output confirms the network is fully open. If Privacy appears in the capability field but no RSN or WPA IE is present, the network may be using WEP rather than WPA — check the ENC column in airodump-ng to confirm.

Check for OWE Transition Mode

Some open networks operate in OWE (Opportunistic Wireless Encryption) transition mode, where a hidden BSSID provides encrypted access for OWE-capable clients while the visible BSSID remains open for legacy clients. The visible open BSSID is still fully unencrypted and capturable regardless of OWE being available.

Check whether an OWE transition partner BSSID is referenced in the beacon:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 30 "AA:BB:CC:DD:EE:FF" | grep -i "OWE\|transition"

OWE transition mode does not change the attack surface of the open BSSID. Traffic from clients that connect to the open BSSID is still unencrypted regardless of whether an OWE partner exists.

Document the Finding

Record the BSSID, SSID, channel, signal strength, and whether the network is internet-facing or internal. An open network enables full passive traffic capture without any active interaction. Connected clients are visible in the airodump-ng station list and their traffic is readable immediately in Wireshark on the same channel.

References