MicroNugget: How to Contain Rogue Access Points in a WLAN

In this video, Keith Barker covers containing rogue access points in a wireless network. If you're running a network, the last thing you need is one of your users finding their way to a malicious network that's spoofing your SSID. Find them and stop them with WLCs.

Large corporate infrastructures or places like airports are common targets for malicious actors to set up a network that looks and feels a lot like your own. They're on the hunt for your users. If they can spoof your network and SSID successfully, they can get one of your users to use their system and compromise them. Then they might turn that device around and use it for a man-in-the-middle attack on your own network and eavesdrop all the traffic that passes through the device.

But wireless LAN controllers are always listening to their downstream access points, who are - in turn - scanning other channels and reporting back to their WLCs what other access points are broadcasting in nearby ranges. The WLC registers those rogue access points, and if you know how to find that registry, you can act to contain the threats.

Start learning with CBT Nuggets:

[IhorSirishtan]

Wonderful video. Superb information presentation. Really enjoyed it!

[ChrisGagnonDIY]

love all your videos. thanks for the micro nugget

[KeithBarker]

Great questions.

The documentation I was just reviewing (from Cisco's site) said that the rogue containment uses between 5-10 percent of the AP's performance, with a cap of 30%, but I didn't see specifics as to how often the flood of deauth messages would be sent.

If the offending AP was in the same frequency bands as our production APs, then that could hurt performance, but the APs would be told to move to a new band (by the wlc) to avoid interference.

Thanks for the questions,

Keith

[armyguy]

Keith, a couple questions.
1. At what interval do the "deauth" messages broadcast?
2. Could the additional noise affect network performance?

Thanks for another great video!

[adedejiemmanuel]

Thanks for the video. Is a "Deauthenticatication attack" the same as the "Disassociation attack"?

[markustoomiste]

What I don't understand is that if you have an access point plugged into your network that isn't managed by the WLC, then how come you need to scan for it with your APs? Wouldn't it come up over the wired traffic?