C. Wired Approaches
Cisco offers a more complete, scalable, and comprehensive
approach using a suite of tools [9] that are not limited by
signal range. They attempt to detect APs by querying routers
and switches for company MAC address assignments (i.e., if
the MAC address belongs to Linksys, the MAC address
cannot belong to a PC and becomes suspicious). This fails
because MAC addresses can be spoofed or cloned easily by
an AP. Another approach in the suite is the use of httpd
query to communicate with the web server residing on the
AP. This is a good approach, but the node must already be
suspected as being an AP (maybe using one of the
aforementioned methods), or every node on the network must
be queried. This approach assumes that the wireless router
responds to httpd queries. Additionally, this invasive
approach is considered active, adding significant unwanted
traffic on the network and can also alert an advanced rogue
AP user of a scan for the AP. The suite also has an
application which allows the viewing of html code generated
when configuring AP settings. Though this approach will
work in theory, the window of opportunity is limited since
this data is only transmitted when the AP’s configuration is
updated. Additionally, as signature-based IDSs can attest,
reassembling application-level data becomes more difficult
and impractical as network speeds increase.
Another LAN only approach is presented by Wimetrics [4].
Their product has a LAN only approach, but is ambiguous
with details. The basic premise of their work is that they
probe the network to identify the profile of a wireless AP.
While the details were unclear, Wimetrics’ general approach
proves not scalable since it requires a PC to sit on each
segment of the network. Their approach unjustly assumes that
the network is a shared network. As discussed in the
previous section, APs can be configured to ignore network
queries.
C. Wired Approaches
Cisco offers a more complete, scalable, and comprehensive
approach using a suite of tools [9] that are not limited by
signal range. They attempt to detect APs by querying routers
and switches for company MAC address assignments (i.e., if
the MAC address belongs to Linksys, the MAC address
cannot belong to a PC and becomes suspicious). This fails
because MAC addresses can be spoofed or cloned easily by
an AP. Another approach in the suite is the use of httpd
query to communicate with the web server residing on the
AP. This is a good approach, but the node must already be
suspected as being an AP (maybe using one of the
aforementioned methods), or every node on the network must
be queried. This approach assumes that the wireless router
responds to httpd queries. Additionally, this invasive
approach is considered active, adding significant unwanted
traffic on the network and can also alert an advanced rogue
AP user of a scan for the AP. The suite also has an
application which allows the viewing of html code generated
when configuring AP settings. Though this approach will
work in theory, the window of opportunity is limited since
this data is only transmitted when the AP’s configuration is
updated. Additionally, as signature-based IDSs can attest,
reassembling application-level data becomes more difficult
and impractical as network speeds increase.
Another LAN only approach is presented by Wimetrics [4].
Their product has a LAN only approach, but is ambiguous
with details. The basic premise of their work is that they
probe the network to identify the profile of a wireless AP.
While the details were unclear, Wimetrics’ general approach
proves not scalable since it requires a PC to sit on each
segment of the network. Their approach unjustly assumes that
the network is a shared network. As discussed in the
previous section, APs can be configured to ignore network
queries.
การแปล กรุณารอสักครู่..
