The "Rig"
Chapter 9.
Optional toolkit components might include the following:
A GPS receiver plugged into your laptop's serial port
A PDA loaded with Kismet or Wellenreiter and some signal strength monitoring utility
More antennas, including semidirectionals
Spare batteries
Amplifier(s)
A rogue wireless backchannel device if you plan to test wireless and physical security. The best example of such a device is a preconfigured small 802.11 USB client that can be quickly and covertly planted on the back of one of the company servers or workstations.
Maps of the area (electronic or paper)
Binoculars (to spot antennas on roofs, etc.)
Transportation means (feet, car, bike, boat, plane, zeppelin, or hot air balloon)
Before doing anything, test that you can capture and decode traffic, crack WEP, and transmit frames (sniff them out) in the testing lab network conditions. Pay special attention to the antenna connectors and their resilience to moving the equipment around. When you are sure that everything works as intended and will work as intended in the field, you can proceed to the next phase. This phase does not involve driving, walking, sailing, or flying around the tested site with protruding antennas. It involves thinking and "Googling."