Detecting an unauthorized station in a wireless local area network

• US 20030221006A1
• Filed: 04/04/2002
• Published: 11/27/2003
• Est. Priority Date: 04/04/2002
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Airmagnet (NetScout Systems Incorporated)
• Inventors: Kuan, Chia-Chee, Wu, Miles, Au, Dean
• Granted Patent: US 7,711,809 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

In a wireless local area network a probe request frame is transmitted over the wireless local area network by a station. The probe request frame is received at a detector in the wireless local area network. The received probe request frame is analyzed to determine if the station that transmitted the probe request frame is an unauthorized station.

Claims

1. A method of detecting an unauthorized station in a wireless local area network comprising:

receiving a probe request frame at a detector in the wireless local area network, wherein the probe request frame is transmitted over the wireless local area network by a station; and

analyzing the probe request frame received at the detector to determine if the station that transmitted the probe request frame is an unauthorized station.

2. The method of claim 1 further comprising:

receiving the probe request frame at an access point; and

sending a probe response frame from the access point.

3. The method of claim 2, wherein the probe request frame has a service set identification address (“

SSID”

), and wherein analyzing the probe request frame comprises;

examining the probe request frame to determine if the length of the SSID is zero;

examining the probe request frame to determine if the probe request frame only has a SSID information element field; and

determining if the station that transmitted the probe request frame fails to proceed with authentication or authorization in response to the probe response frame.

4. The method of claim 1, wherein analyzing the probe request frame comprises:

determining if the station that transmitted the probe request frame is engaging in a war driver activity.

5. The method of claim 4, wherein determining if the station is engaging in a war driver activity comprises:

determining if the probe request frame has a service set identification address (“

SSID”

) with a length of zero;

determining if the probe request frame only has a SSID information element field; and

determining if the station that transmitted the probe request frame fails to proceed with authentication or authorization in response to a probe response frame sent from an access point.

6. The method of claim 1, wherein the probe request frame is received below a network layer in an OSI model.

7. The method of claim 1, wherein the probe request frame is sent and received according to the IEEE 802.11 standard.

8. The method of claim 1, wherein the detector is a station in the wireless local area network.

9. A method of detecting an unauthorized station in a wireless local area network engaging in “

war driver”

activity, the method comprising;

receiving a probe request frame sent from a station at a detector; and

analyzing the probe request frame at the detector to determine if the station that sent the probe request frame is an unauthorized station.

10. The method of claim 9, wherein analyzing the probe request frame comprises:

determining if the probe request frame has a service set identification address (“

SSID”

) with a length of zero;

determining if the probe request frame only has a SSID information element field; and

determining if the station fails to proceed with authentication or authorization in response to a probe response frame sent from an access point.

11. The method of claim 10 further comprising:

identifying the station that sent the probe request frame as an unauthorized station if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.

12. The method of claim 10 further comprising:

identifying the station that sent the probe request frame as engaging in “

war driver”

activity if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.

13. A method of detecting an unauthorized station in a wireless local area network engaging in “

war driver”

activity, the method comprising;

receiving a probe request sent by a station in the wireless local area network;

receiving a probe response frame sent by an access point in the wireless local area network, wherein the probe request frame is sent in response to the probe request frame; and

determining if;

the probe request frame includes a service set identification address (“

SSID”

) with a length of zero,

the probe request frame only has a SSID information element field, and

the station that sent the probe request frame fails to proceed with authentication or authorization in response to the probe response frame.

14. A system of detecting an unauthorized station in a wireless local area network comprising:

an access point configured to send a probe response frame in response to a probe request frame sent from a station; and

a detector configured to;

receive the probe request frame sent from the station, and

analyze the probe request frame to determine if the station is an unauthorized station.

15. The system of claim 14, wherein the detector is configured to:

analyze the probe request frame to determine if the probe request frame has a service set identification address (“

SSID”

) that has a length of zero;

analyze the probe request frame to determine if the probe request frame only has a SSID information element field; and

determine if the station fails to proceed with authentication or authorization in response to the probe response frame.

16. The system of claim 15, wherein the detector is configured to identify the station as an unauthorized station if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.

17. The system of claim 15, wherein the detector is configured to identify the station as engaging in a war driver activity if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.

18. The system of claim 14, wherein the detector is a station in the wireless local area network.

19. A computer-readable storage medium containing computer executable code to detect an unauthorized station in a wireless local area network by instruction the computer to operate as follows:

receiving a probe request frame sent from a station at a detector; and

analyzing the probe request frame at the detector to determine if the station is an unauthorized station.

20. The computer-readable storage medium of claim 19, wherein analyzing the probe request frame comprises:

determining if the probe request frame has a service set identification address (“

SSID”

) with a length of zero;

determining if the probe request frame only has a SSID information element field; and

determining if the station fails to proceed with authentication or authorization in response to a probe response frame sent from an access point.

21. The computer-readable storage medium of claim 20 further comprising:

identifying the station as an unauthorized station if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.

22. The computer-readable storage medium of claim 20 further comprising:

identifying the station as engaging in “

war driver”

activity if the probe request frame has a SSID length of zero, the probe request frame only has a SSID information element frame, and the station fails to proceed with authentication or authorization in response to a probe response frame.