Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Wireless Intrusion Prevention | 46 5
network equipment. Denial of Service attack detection encompasses both rate analysis and the detection of a
specific DoS attack known as Fake AP.
Rate Analysis
Many DoS attacks flood an AP or multiple APs with 802.11 management frames. These can include authenticate/
associate frames which are designed to fill up the association table of an AP. Other management frame floods,
such as probe request floods, can consume excess processing power on the AP. The Dell controller can be
configured with the thresholds that indicate a DoS attack and can detect the same. Refer to “Denial of Service
(DoS) Detection” on page 464 for more details.
Fake AP
Fake AP is a tool that was originally created to thwart wardrivers by flooding beacon frames containing hundreds
of different addresses. This would appear to a wardriver as though there were hundreds of different APs in the
area, thus concealing the real AP. While the tool is still effective for this purpose, a newer purpose is to flood
public hotspots or enterprises with fake AP beacons to confuse legitimate clients and to increase the amount of
processing client operating systems must do. Refer to “Denial of Service Attack Detection” on page 468 for more
details.
Impersonation Detection
A successful man-in-the-middle attack will insert an attacker into the data path between the client and the AP. In
such a position, the attacker can delete, add, or modify data, provided he has access to the encryption keys. Such
an attack also enables other attacks that can learn a client’s authentication credentials. Man-in-the-middle
attacks often rely on a number of different vulnerabilities.
Station Disconnection
Spoofed deauthenticate frames form the basis for most denial of service attacks, as well as the basis for many
other attacks such as man-in-the-middle. In a station disconnection attack, an attacker spoofs the MAC address
of either an active client or an active AP. The attacker then sends deauthenticate frames to the target device,
causing it to lose its active association. In addition to a deauthentication frame, Reassociate, Authenticate, and
Disassociate frames can also cause the target device to lose its active association.
EAP Handshake Analysis
EAP (Extensible Authentication Protocol) is a component of 802.1x used for authentication. Some attacks, such
as “ASLEAP” (used to attack Cisco LEAP) send spoofed deauthenticate messages to clients in order to force the
client to re-authenticate multiple times. These attacks then capture the authentication frames for offline
analysis. EAP Handshake Analysis detects a client performing an abnormal number of authentication procedures
and generates an alarm when this condition is detected.
Sequence Number Analysis
During an impersonation attack, the attacker will generally spoof the MAC address of a client or AP. If two
devices are active on the network with the same MAC address, their 802.11 sequence numbers will not match –
since the sequence number is usually generated by the NIC firmware, even a custom driver will not generally be
able to modify these numbers. Sequence number analysis will detect possible impersonation attacks by looking
for anomalies between sequence numbers seen in frames in the air.
AP Impersonation
AP impersonation attacks can be done for several purposes, including as a Man-In-the-Middle attack, as a rogue
AP attempting to bypass detection, and as a possible honeypot attack. In such an attack, the attacker sets up an
AP that assumes the BSSID and ESSID of a valid AP.