Rogue Access Point Blocking Using WiFi Manager

Toll Free US: +1 888 720 9500 | Intl: +1 925 924 9500
+1 800 443 6694 (alternative number)
Australia: +1 800 631 268

Store | Reseller

All Products

WiFi Manager

WLAN Management

German

WiFi Manager is an integrated management & security solution for WLANs:

Multi-vendor/model access point monitoring and management
Easy and uniform configuration templates
Visually manage multi-site, distributed environments
Robust reporting abilitiess

Success Stories
"I am impressed with WiFi Manager's features, given its reasonable cost." - Alan Ballenberger, Siena Heights University.

Rogue Access Point Detection

Rogue Client Detection

Rogue Access Point Blocking

Once a rogue AP is discovered the next immediate step is to block the AP from the network so that the authorized clients don’t associate with it. There are two ways of blocking the rogue APs.

Tit for Tat: Launch a Denial-of-service (DoS) attack on the rogue AP and make it deny wireless service to any new client.
Pull it out of the network, manually
Blocking the switch port to which the AP is connected.

Launching a DoS attack on the rogue

AP Most Wireless IDS vendors follow this practice. This is kind of using offense for defense. Once a rogue AP is detected the WLAN administrator can use the sensor to launch a DoS attack on it by sending numerous disassociation packets.

Disassociation Attack on rogue AP

Figure 1: Rogue blocking by sending disassociation packets

How disassociation attack works?

IEEE 802.11 defines a client state machine for tracking station authentication and association status. Wireless clients and APs implement such a state machine (refer illustration below) based on the IEEE standard. A successfully associated client station stays in State 3 in order to continue wireless communication. A client station in State 1 and State 2 cannot participate in the WLAN data communication process until it is authenticated and associated. IEEE 802.11 also defines two authentication services: Open System Authentication and Shared Key Authentication. Wireless clients go through one of the two-authentication process to associate with an AP.

Disassociation Flood Attack is a form of denial of service attacks that forces a client to the unassociated/authenticated state (State 2) by spoofing disassociation frames from the AP to a client. Typically, client stations would re-associate to regain service until the attacker sends another disassociation frame. An attacker would repeatedly spoof the disassociation frames to keep the client out of service.

Disassociation Attack

Figure 2: Disassociation Attack Model Diagram

Pulling an AP off the LAN

This is manual work. The administrator can walk up to the rogue AP and pull it off the LAN. In many cases it would be an over enthusiastic employee who has installed the AP for wireless communication.

Blocking the switch port

Wireless network management software offers this functionality. Once the rogue AP is detected the software will look for the rogue AP’s MAC address in all the switches connected in the LAN. The port at which the MAC is connected can then be blocked for any LAN traffic. This would automatically prevent the clients connected to the AP from dropping the connection and get associated to the nearest AP. This is a very effective technique.

Switch Port Blocking

Figure 3: Switch Port Blocking using WiFi Manager

Rogue Access Point Detection

Rogue Client Detection

Enterprise Management & Security Products
Active Directory Management Active Directory Auditing Application Monitoring Asset Management Bandwidth Monitoring & Traffic Analysis Customer Support Software Desktop Management EventLog Analyzer Facilities Management Firewall Analyzer Free Active Directory Tools Free Windows Tools Help Desk Software Load Testing	MSP Platform MSP Help Desk Software Network Configuration Management Network Monitoring Software Network Security Scanner with Patch Management OS Deployment Password Management Self-Service Password Management Storage Management Software Switch Port & IP Address Management VoIP Monitoring WiFi Manager Website Monitoring (SaaS)

Features

White Papers

Rogue Detection & Blocking

Forums

View All Forums

Product List
Active Directory Management Active Directory Auditing Application Monitoring Asset Management Bandwidth Monitoring & Traffic Analysis Customer Support Software Desktop Management	EventLog Analyzer Facilities Management Firewall Analyzer Free Active Directory Tools Free Windows Tools Help Desk Software Load Testing	MSP Platform MSP Help Desk Software Network Configuration Management Network Monitoring Software Network Security Scanner with Patch Management OS Deployment	Password Management Self-Service Password Management Storage Management Software Switch Port & IP Address Management VoIP Monitoring WiFi Manager Website Monitoring (SaaS)