User's Guide

eectiveness while performing regular Wireless IPS scanning on other channels. More than one sensor
can cloak a single wireless device depending on spatial coverage.
Once configured for cloaking, sensors intelligently analyze local trac and insert carefully timed
cloaking frames as shown in the figure below. To attackers, who do not have the secret WEP key, these
cloaking frames appear as legitimate WEP trac between sanctioned devices. Sanctioned devices,
configured with the production WEP key, automatically ignore the cloaking frames as their integrity test
fails.
An attacker sning trac will not be able to distinguish between cloaking frames and legitimate
frames, and therefore, cannot filter out the cloaked frames. When statistical WEP cracking tools are run
on the captured data, they simply fail to decode the key. The following figure shows a screenshot of
Aircrack-ng with WEP Cloaking enabled.
WEP Cloaking
Legacy Content
1388 Extreme AirDefense User Guide for version 10.5.