A Passive Approach to Rogue Access Point Detection IEEE GLOBECOM 2007 Lanier Watkins Raheem Beyah Cherita Corbett 김진석

Contents Introduction Related Works Main Idea Experiment and Result Conclusion Discussion

Instruction Rogue AP? ◦Unauthorized AP ◦Produces Security Vulnerabilities ◦Unmonitored Point of Entry (to Private Network) Detection ◦Difficult to Detect ◦Hidden AP (Location and No Broadcasting) ◦No Information from Rogue AP and Offender

Instruction RTT? ◦Round Trip Time ◦Time Between Sending Packet and Receiving Response ◦Related Works  Optimization of Protocol for Link Characteristic  RTT in QoS Issue

Related Works Wireless vs. Wired Active vs. Passive Wired and Passive Approach!

Related Works Wireless vs. Wired ◦Wireless : Using APs, Sensors, Walking the Halls..  Time/Cost Consuming  Detection Time is Limited  Frequency Problem  Sensing Range  Disable the SSID Broadcasting  Low Signal Strength / Directional Antenna

Related Works Active vs. Passive ◦Active : Using Queries, New Packets  Network Load Increased  Rogue APs can Ignore Queries ◦Passive : MAC Address, Using Ack-pairs..  MAC Address can be spoofed/cloned  Converging time -> In In-line Deployment?

Main Idea Total delay = d prop + d trans + d proc + d queue Total delay = d trans = packetsize / capacity Same Higher-layer Protocol (TCP/IP) d trans -> Characteristic of Physical-Layer

Main Idea

Experiment Very Simple Testbed No Other Traffic Using Same Laptops for Node

Result

Result

Result

Result

Conclusion Wireless nodes have greater RTT RTT and Authorized AP Information (Capacity)Wired >> Wireless Result of DCF, Using Variation Wired/Passive!

Discussion Limited to TCP/IP (Other Protocols?) Simple Test Bed -> Complex Network Computational Capacity of Nodes Assumption : Wired >> Wireless = True?