How can we trace wireless attack sources?

Q: I need a tool that can locate DoS attacks in a wireless LAN. Although the wireless intrusion defense system WIPS in use can provide the alarm function when an attack occurs, I still need to know which tool can locate the specific location of the device that initiates the attack.

A: When an attack occurs, WIPS can locate the approximate attack location, or at least display the sensor device or AP closest to the attack source. In view of this, you can find the attack source by listening to the RF at the specific location.

If the attack source happens to be a Wi-Fi AP or Ad Hoc node, resulting in co-frequency interference, you can only listen through any Wi-Fi discovery tool, also known as "stumbler. View the list of wireless security tools. For example, the best AP ing tool is HeatMapper.

If the attack source is a Wi-Fi client, you need a tool that can enter RFMON mode and listen to other Wi-Fi traffic, not just an AP or Ad Hoc pointer. AirPCap adapter is required for running Linux) or Airodump-ng, Kismet, and Wireshark on Windows are competent. Commercial WLAN analysis tools can also capture client traffic.

If the attack source is not a Wi-Fi device, you need a mobile RF spectrum analysis device with the "Search" function. Some commercial devices already have this feature, such as MetaGeek Wi-Spy.

Note: When you are looking for an attack source, the attack device must be in operation. This requirement seems obvious, but it also brings some challenges: especially when DoS attacks prove to be Transient RF interference. Let's take a look at the historical data generated by WIPS and the real-time observation results of the sensors and AP. When we find attacks again, you may want to use WIPS with the "View" function to trigger sensor-based remote packet capture. In addition, WIPS also recommends the best time to search for attack sources in a day based on the event history. Finally, some new enterprise APS can provide on-board spectrum analysis devices-if your "DoS attack" does have chronic RF interference problems, this investment is worth it.

1. Six new myths about wireless security
2. Eight Methods for hacker attacks and intrusions