Users Guide

464 | Wireless Intrusion Prevention Dell PowerConnect ArubaOS 5.0 | [User Guide
Adhoc Network Detection and Containment
As far as network administrators are concerned, ad-hoc wireless networks are uncontrolled. If they do not use
encryption, they may expose sensitive data to outside eavesdroppers. If a device is connected to a wired network
and has bridging enabled, an ad-hoc network may also function like a rogue AP. Additionally, ad-hoc networks can
expose client devices to viruses and other security vulnerabilities. For these reasons, many administrators choose
to prohibit ad-hoc networks. The Dell system can perform both ad-hoc network detection and also disable ad-hoc
networks when they are found.
Wireless Bridge Detection
Wireless bridges are normally used to connect multiple buildings together. However, an attacker could place (or
have an authorized person place) a wireless bridge inside the network that would extend the corporate network
somewhere outside the building. Wireless bridges are somewhat different from rogue APs in that they do not use
beacons and have no concept of association. Most networks do not use bridges— n these networks, the presence
of a bridge is a signal that a security problem exists.
Misconfigured AP Detection
If desired, a list of parameters can be configured that defines the characteristics of a valid AP. This is primarily
used when non-Dell APs are being used in the network since the Dell controller cannot configure the third-party
APs. These parameters can include preamble type, WEP configuration, OUI of valid MAC addresses, valid
channels, DCF/PCF configuration, and ESSID. The system can also be configured to detect an AP using a weak
WEP key. If a valid AP is detected as misconfigured, the system will deny access to the misconfigured AP if
protection is enabled. In cases where someone gains configuration access to a third-party AP and changes the
configuration, this policy is useful in blocking access to that AP until the configuration can be fixed.
Weak WEP Detection
The primary means of cracking WEP keys is by capturing 802.11 frames over an extended period of time and
searching for patterns of WEP initialization vectors (IVs) that are known to be weak. The Dell system will
monitor for devices using weak WEP implementations and generate reports for the administrator of which
devices require upgrades.
Multi Tenancy Protection
The Dell system provides the ability to configure SSID lists, and disable unrecognized APs using these reserved
resources. This feature can be used in a multi-tenant building where different enterprises must share the RF
environment. This feature can also be used to defend against “honeypot” APs. A “honeypot” AP is an attacker’s
AP that is set up in close proximity to an enterprise, advertising the ESSID of the enterprise. The goal of such an
attack is to lure valid clients to associate to the honeypot AP. From that point, a man in the middle (MITM)
attack can be mounted, or an attempt can be made to learn the client’s authentication credentials. Most client
devices have no way of distinguishing between a valid AP and an invalid one – the devices only look for a
particular ESSID and will associate to the nearest AP advertising that ESSID.
MAC OUI Checking
The Dell system provides the ability to match MAC addresses seen in the air with known manufacturers. The first
three bytes of a MAC address are known as the MAC OUI (Organizationally Unique Identifier) and are assigned
by the IEEE. Often, clients using a spoofed MAC address will not use a valid OUI, and instead use a randomly
generated MAC address. By enabling MAC OUI checking, administrators will be notified if an unrecognized
MAC address is in use.
Denial of Service (DoS) Detection
DoS attacks are designed to prevent or inhibit legitimate clients from accessing the network. This includes
blocking network access completely, degrading network service, and increasing processing load on clients and