Ask the Expert

Hunting down the source of a wireless attack

Question: I am looking for a tool which would help in physically locating a denial of service (DoS) attacker of a Wireless LAN. I do have a wireless intrusion prevention system (WIPS) which is constantly alerting me to the attack, but need some info on what tool I would use to try and locate the device(s).

    Requires Free Membership to View

Your WIPS should depict the approximate location of the attacker on a floorplan, or at least tell you the sensors/APs closest to the attacker. Given that as a starting point, you'll need to try to find the device by listening to RF that location.

• If the "attacker" happens to be a Wi-Fi AP or Ad Hoc node causing co-channel interference, you can hear it with just about any Wi-Fi discovery tool (aka "stumbler"). See my list of Wireless Security Tools. For example, a good free tool for mapping APs is HeatMapper.

• If the attacker is a Wi-Fi client, you'll need something that can enter RFMON mode and listen to other Wi-Fi traffic, not just AP or Ad Hoc beacons. Some free examples include Airodump-ng, Kismet, or Wireshark, running on Linux or (with an AirPCap adapter) on Windows. Commercial WLAN analyzers can also capture client traffic.

• If the attacker is a non-Wi-Fi device, you'll need a mobile RF spectrum analyzer with a "find" capability. That's commercial product territory right now, but one good example is MetaGeek Wi-Spy. ,

Note that the "attacker" must be active when you're searching. This might seem obvious but it can pose a real challenge – especially for DoS attacks that turn out to be transient RF interference. Look at both historical data gathered by your WIPS and real-time observations from sensors and APs. You might be able to use a WIPS "watch" to trigger a sensor-based remote packet capture the next time the attacker is heard. WIPS event history may suggest the best time of day to find the attacker active. Finally, some new enterprise APs provide on-board spectrum analysis – this investment could prove worthwhile if your "DoS attacks" are really chronic RF interference problems.

This was first published in August 2010

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: