Disrupting an ad-hoc wireless network

• US 7,596,109 B1
• Filed: 12/16/2005
• Issued: 09/29/2009
• Est. Priority Date: 12/16/2005
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Airmagnet (NetScout Systems Incorporated)
• Inventors: Farrington, Ricardo Tomas
• Primary Examiner(s): MEHRPOUR, NAGHMEH
• Application Number:
  US11/303,691
• Time in Patent Office: 1,383 Days
• Field of Search: 455/414.1, 455/456.2, 455/404.1, 455/434, 455/503, 455/562.1, 455/522, 455/60, 370/312, 370/465, 370/329, 370/338, 705/3, 705/26, 705/9
• US Class Current: 370/312
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

An ad-hoc wireless network is disrupted by first obtaining a beacon or data frame sent by a station. The beacon or data frame is then examined to determine whether the station that sent the beacon or data frame is operating in an ad-hoc mode on the ad-hoc wireless network. If the station is determined to be operating in an ad-hoc mode, then a blocking frame, which is a beacon frame, is sent on the ad-hoc wireless network to disrupt the ad-hoc wireless network by changing the operational characteristic of the ad-hoc wireless network.

Claims

1. A method of disrupting an ad-hoc wireless network, the method comprising:

a) obtaining a beacon or data frame sent by a station;

b) examining the beacon or data frame to determine whether the station that sent the beacon or data frame is operating in an ad-hoc mode on the ad-hoc wireless network, the beacon or data frame having a first data associated with an operational characteristic of the ad-hoc wireless network; and

c) if the station is determined to be operating in the ad-hoc mode in b), sending a blocking frame having a second data associated with the operational characteristic on the ad-hoc wireless network to disrupt the ad-hoc wireless network, wherein the second data is set by changing the first data associated with the operational characteristic of the ad-hoc wireless network, wherein the blocking frame is a beacon frame.

2. The method of claim 1, further

comprising:

receiving a frame sent by a station;

identifying whether the received frame is a beacon or data frame;

if the received frame is a beacon or data frame, performing steps a)-c) of claim 1 using the received frame as the beacon or data frame; and

if the received frame is not a beacon or data frame, disregarding the received frame and not performing steps a)-c) of claim 1 using the received frame as the beacon or data frame.

3. The method of claim 1, wherein b) comprises:

when a beacon frame is obtained in a), examining a capability information field in the beacon frame, wherein the capability information field includes a extended service set subfield and an independent basic service set subfield; and

if the extended service set subfield is a zero and the independent basic service set subfield is a one, determining that the station is operating in an ad-hoc mode in the ad-hoc wireless network.

4. The method of claim 1, wherein b) comprises:

when a data frame is obtained in a), examining a frame control field of the data frame, wherein the frame control field includes a To OS subfield and a From OS subfield; and

if the To OS subfield and the From DS subfield are both zero, then determining that the station is operating in an ad-hoc mode in the ad-hoc wireless network.

5. The method of claim 1, wherein the blocking frame is sent as a unicast frame only to the station on the ad-hoc wireless network that sent the beacon or data frame.

6. The method of claim 5, wherein c) further comprises:

if the station is determined to be operating in an ad-hoc mode in the ad-hoc wireless network, examining the beacon or data frame to determine source address of the beacon or data frame, and wherein the blocking frame includes a destination address, and wherein the blocking frame is sent with the destination address set to the determined source address of the beacon or data frame.

7. The method of claim 1, wherein the blocking frame is sent as a broadcast frame to all stations on the ad-hoc wireless network.

8. The method of claim 1, wherein sending a blocking frame comprises:

sending a first blocking frame as a unicast frame only to the station on the ad-hoc wireless network that sent the beacon or data frame; and

sending a second blocking frame as a broadcast frame to all stations on the ad-hoc wireless network.

9. The method of claim 1, wherein the blocking frame is sent with a timestamp field set to a high end of the possible range of values.

10. The method of claim 9, further comprising:

sending one or more subsequent blocking frames, wherein the values of the timestamp fields of the subsequent blocking frames increase non-linearly.

11. The method of claim 10, wherein the values of the timestamp fields of the subsequent blocking frames increase logarithmically.

12. The method of claim 10, wherein the values of the timestamp fields of the subsequent blocking frames increase pseudo-randomly or randomly.

13. The method of claim 1, wherein the beacon frame was sent on a specified OS channel, and

wherein the blocking frame is sent with an OS channel subfield set to a different channel than the specified OS channel of the beacon frame.

14. The method of claim 13, further comprising:

sending one or more subsequent blocking frames, wherein the DS channel subfields of the subsequent blocking frames are set to different channels.

15. The method of claim 1, wherein the beacon frame was sent with a privacy subfield set on or off, wherein the blocking frame is sent with a privacy subfield set different than the beacon frame.

16. The method of claim 15, further comprising:

sending one or more subsequent blocking frames, wherein the privacy subfields of the subsequent blocking frames are set to different settings.

17. The method of claim 1, wherein the beacon frame was sent with a supported rates field set to a value, wherein the blocking frame is sent with a supported rates field set to a different value than the beacon frame.

18. The method of claim 17, further comprising:

sending one or more subsequent blocking frames, wherein the supported rates fields of the subsequent blocking frames are set to different values.

19. The method of claim 1, wherein sending a blocking frame comprises:

sending a series of blocking frames, wherein the series of blocking frames are sent with one or more of the following settings to change the operational characteristic of the ad hoc wireless network;

OS channel subfields of the blocking frames set to different channels;

privacy subfields of the blocking frames set to different settings; and

supported rates fields of the blocking frames set to different values.

20. The method of claim 19, wherein the timestamp fields of the blocking frames are set to values high in the range of possible values, and wherein the values of the timestamp fields of the blocking frames increase non-linearly.

21. A computer-readable storage medium storing computer executable code to disrupt an ad-hoc wireless network by instructing a processor or computer to operate as follows:

a) obtaining a beacon or data frame sent by a station;

b) examining the beacon or data frame to determine whether the station that sent the beacon or data frame is operating in an ad-hoc mode on the ad-hoc wireless network, the beacon or data frame having a first data associated with an operational characteristic of the ad-hoc wireless network; and

c) if the station is determined to be operating in the ad-hoc mode in b), sending a blocking frame having a second data associated with the operational characteristic on the ad-hoc wireless network to disrupt the ad-hoc wireless network, wherein the second data is set by changing the first data associated with the operational characteristic of the ad-hoc wireless network, wherein the blocking frame is a beacon frame.

22. The computer-readable storage medium of claim 21, wherein sending a blocking frame comprises:

sending a series of blocking frames, wherein the series of blocking frames are sent with one or more of the following settings to change the operational characteristic of the ad-hoc wireless network;

OS channel subfields of the blocking frames set to different channels;

privacy subfields of the blocking frames set to different settings; and

supported rates fields of the blocking frames set to different values.

23. The computer-readable storage medium of claim 22, wherein the timestamp fields of the blocking frames are set to values high in the range of possible values, and wherein the values of the timestamp fields of the blocking frames increase non-linearly.

24. A blocking device for using in a wireless local area network to disrupt an ad-hoc wireless network, the blocking device comprising:

a wireless antenna configured to receive a beacon or data frame sent by a station; and

a processor configured to;

examine the received beacon or data frame to determine whether the station that sent the beacon or data frame is operating in an ad-hoc mode on the ad-hoc wireless network, the beacon or data frame having a first operational characteristic of the ad-hoc wireless network; and

if the station is determined to be operating in the ad-hoc mode, send a blocking frame having a second data associated with the operational characteristic on the ad-hoc wireless network to disrupt the ad-hoc wireless network, wherein the second data is set by changing the first data associated with the operational characteristic of the ad-hoc wireless network, wherein the blocking frame is a beacon frame.

25. The blocking device of claim 24, wherein the blocking frame is sent by:

sending a series of blocking frames, wherein the series of blocking frames are sent with one or more of the following settings to change the operational characteristic of the ad-hoc wireless network;

OS channel subfields of the blocking frames set to different channels;

privacy subfields of the blocking frames set to different settings; and

supported rates fields of the blocking frames set to different values.

26. The blocking device of claim 25, wherein the timestamp fields of the blocking frames are set to values high in the range of possible values, and wherein the values of the timestamp fields of the blocking frames increase non-linearly.