Wardriving: Origins, Terms, and Early Tooling

Wardriving grew out of an earlier practice known as wardialing. Back in the 1980s and 1990s, wardialing meant to call large blocks of phone numbers in sequence to find systems with modems attached. The idea is closely tied to the 1983 film WarGames, which helped push that kind of exploration into mainstream tech culture.^[1] As wireless networking spread, that same mindset moved from telephone lines to radio waves. Instead of dialing number ranges, researchers began scanning for 802.11 networks, logging what they found, and tying it to physical locations. That shift is what gave rise to wardriving as most people came to understand it.

One of the key early figures in wardriving was Peter Shipley. In 2001, he presented 802.11b War Driving and Lan Jacking at DEF CON 9, and his slide deck describes an 18-month survey effort that began in the fall of 2000.^[2][3] His work helped document just how widespread unsecured wireless networks already were, and it gave the broader security community one of its earliest clear looks at wireless reconnaissance in practice.

Shipley’s setup already had most of what people would come to associate with wardriving: a laptop, an external antenna, a GPS receiver, and Wi-Fi hardware for finding nearby access points. His 2001 slides list tools such as NetStumbler, dStumbler, and custom scripts, and they describe logging SSIDs, MAC addresses, signal strength, channel, location, and security settings.^[2][3] At its core, that is still what wardriving is: finding wireless networks and tying what you see to a physical location.

A related term, warchalking, emerged in 2002. Matt Jones proposed using chalk symbols in public spaces to mark nearby wireless networks, borrowing from the visual language of old hobo signs. It got plenty of attention at the time, but in practice it was more of a cultural offshoot than a serious method for sharing wardriving data.^[4]

Early on, the tools split into two main camps. NetStumbler used active scanning, meaning it sent probe requests rather than just listening.^[5] Its own release notes say it did that about once per second and did not support passive scanning in that version.^[5] Kismet took the quieter approach. Its documentation describes it as operating almost entirely passively, which made it better suited for listen-only surveying and longer-term collection.^[6]

That difference between active and passive scanning mattered. Active tools were simple and effective, but they also transmitted traffic. Passive tools were quieter and closer to pure observation, which made them better for mapping what was already in the air without directly interacting with the target network.^[5][6]

What started as local surveys eventually grew into shared mapping platforms. WiGLE, short for Wireless Geographic Logging Engine, has been collecting and mapping wireless data since 2001.^[7] The hardware has changed, and people are no longer limited to collecting it from a car, but the basic goal is still the same: find wireless networks and infrastructure, tie what you see to a physical location, and build a map from the results.