1

Wireless Network Monitoring

Plan B ProjectSandeep P Karanth

Advisor: Prof. Anand Tripathi

2

Outline

• Introduction• Overview of Konark• IEEE 802.11 Wireless LANs• Potential Threats to a Wireless LAN• Modes of Operation• Detection Logic • Conclusions and Future work

3

Introduction

• Network Monitoring issues:• Large Networks• Heterogeneous components• Distributed monitoring• Centralized event-viewing and control• Quick Response to alerts

• Response against attackers/intruders• Response against misconfigurations/failures

• Robust and Secure system

4

Konark: Overview

• Mobile-Agent based network monitoring

• Object capable of migration• first-class objects – altered remotely• Programming framework – Ajanta

• Script based detection techniques• tedious to install, debug and modify• coarse-grained protection

5

Konark: Overview (Contd..)

•Goals:• Dynamically Extensible

• Addition of new monitoring components• Modification of existing monitoring policies• Integration of tools

• Active Monitoring• Modification of policies in response to events

• Online Monitoring• Event monitoring in real-time

6

Konark: Overview (Contd..)

•Goals (contd..):• Resilience by diverse monitoring sources • Secure

• System itself has to be secure• Robust

• Automated recovery of failed system components

• Scalable• Acceptable System Performance

7

Konark: Overview (Contd..)• Publish-Subscribe network monitoring system• Monitoring agents equipped with detectors• Publisher-subscriber relationship is dynamic• Event model for information flow• Automated agent and detector recovery

• Uses self-monitoring schemes• Authenticated inter-agent communication (RMI)

• Challenge-response protocol

8

Konark: Overview (Contd..)

9

IEEE 802.11 Wireless LAN

• IEEE 802.11 operates at PHY and MAC• Operating modes:

• Infrastructure• Ad hoc

• Carrier Sense Multiple Access (CSMA)• Collision Avoidance (CA)• Binary Exponential Back-off algorithm

10

IEEE 802.11 Wireless LAN (contd..)

• Terminology:• Access Point (AP) • Service Set Identifier (SSID)• Basic Service Set (BSS)• Independent BSS (IBSS) – Adhoc network• Extended Service Set (ESS) – APs having same SSID• Distribution System (DS) – connects APs• Wired Equivalent Privacy (WEP)

11

IEEE 802.11 Wireless LAN (contd..)

• Generic 802.11 frame format

12

IEEE 802.11 Wireless LAN (contd..)

• Generic Management frame

13

IEEE 802.11 Wireless LAN (contd..)

• Association Process

14

IEEE 802.11 Wireless LAN (contd..)

• Frame types:• Beacon Frame – AP advertisement• Probe Request / Response • Reassociation Request / Response

• Authentication:• Open Authentication (MAC ACLs used)• Shared Key authentication

15

Potential Threats and Management Issues

• MAC Address Spoofing:• Attacker impersonates a legitimate client• Attacker fakes as a legitimate AP (Fake AP)• Attacker sends spoofed deauthenticate/disassociate frames

• Denial-Of-Service Attacks:• Authenticate/Associate message floods on AP• RTS frame floods

16

Potential Threats and Management issues (contd..)

• Network Misconfigurations / Failures• AP failure• Unauthorized or Rogue APs

• May not conform to security policies• Policy Conformance

• Acceptable signal strengths• Acceptable data rate• Correct SSIDs

• Attack Tools: macchanger, FakeAP, LibRadiate

17

Design Goals

• Monitoring Objectives• Attack Detection and response• Unauthorized use detection and response• Component failure detection

• Service Provisioning Objectives:• User tracking service – Pervasive applications

18

Modes of Monitoring System Operation:

• Mode 1:• Notebooks/PCs executing a monitoring daemon• Statically placed• Strategically placed to get entire network coverage

• Mode 2:• A PDA/handheld running a monitoring daemon

19

Modes of Monitoring System Operation(Contd…)

• Mode 2: (contd..)• Campus walk taken by wireless security auditor

• Mode 3:• Access Points log information to a syslog file• Syslog file analyzed for event generation

20

Modes of Monitoring System Operation(Contd…)

21

Detection Logic and Response

• Sequence number Analysis:• Each frame has a 12-bit sequence number• Put in by the firmware• Range of sequence numbers: 0 - 4095• Sequence numbers of 2 stations are not likely to be the same• Fake and legitimate station will have out-of-order sequence numbers

22

Detection Logic and Response (contd..)

• Sequence number analysis (contd..):• Packet capturing software and dump analyzer used to analyze • Dump analyzer slower than capturing software (packets captured are dropped)• Only 1 in 10 beacon frames analyzed to account for slow analysis•Threshold of 20 chosen for difference in seq. no. for the same source

23

Detection Logic and Response (contd..)

• Sequence number analysis (contd..):• Detection Capabilities:

• Faking client detection• Fake AP detection• Forced disassociation/deauthentication

• Fails if unauthorized user connects in a disjoint time frame

• Likely time policy• Inform users when they connect

24

Detection Logic and Response (contd..)

• Sequence number analysis (contd..):• Fails if unauthorized user connects to another BSS in an ESS

• Konark monitoring agents perform distributed correlations to detect this• Correlation of events among AP logs helps us detect this

25

Detection Logic and Response (contd..)

• Packet counting and analysis• Packets sent to an AP are recorded• Many packets in a small adjustable interval indicate a DOS attack• AP logs also examined to detect such attacks

26

Detection Logic and Response (contd..)

• Misconfiguration/Failure detection• Missing beacons imply AP failure

• Beacons may be disabled in an AP (policy)• Ping every AP with a probe request

• Extraneous beacons/ frames with unknown BSSID implies Rogue APs

• Network baseline fed to the daemon at startup

• Repeated associations, DHCP denials or unknown frame transmittals imply brute force attacks or client misconfiguration

27

Detection Logic and Response (contd..)

28

Experimental Setup

• Experiments conducted on the EECS building wireless LAN (802.11b)• Cisco Access Points (Aironet 340/350 series)• Notebook PCs running Linux used to conduct experiments• Cisco 340/350 wireless cards used for wireless connectivity

29

Experimental Setup (contd..)

• Packet capturing software used Kismet (Development version 2.8.1)• Dump analyzer – Ethereal

Kismet EtherealMonitoringDaemon

Named pipe

Pipe

Capture packets Decode packets Analyze decoded packets

30

Experimental Setup

• About 90-95% of the frames observed are IEEE 802.11 management frames• Beacon frames form 90% of the management frames• Beacon interval is 0.1024 seconds

31

Experimental Setup

Mon May 26 15:31:00 2003 Deauthentication SrcAddr:00:40:96:47:99:13 DestAddr:00:40:96:33:4c:8c BSSID:00:40:96:47:99:13

Mon May 26 15:31:00 2003 Deauthentication SrcAddr:00:40:96:47:99:13 DestAddr:00:40:96:33:4c:8c BSSID:00:40:96:47:99:13

Mon May 26 15:31:00 2003 Authentication SrcAddr:00:40:96:33:4c:8c DestAddr:00:40:96:47:e6:ec BSSID:00:40:96:47:e6:ec

Mon May 26 15:31:01 2003 Sequence number mismatch: SrcAddr:00:40:96:41:d4:01 Details:Unauthorized Client suspected

Mon May 26 15:31:01 2003 Reassociation Request SrcAddr:00:40:96:33:4c:8c DestAddr:00:40:96:47:e6:ec BSSID:00:40:96:47:e6:ec

Mon May 26 15:31:04 2003 Sequence number mismatch: SrcAddr: 00:40:96:41:d4:01 Details:Unauthorized Client suspected

32

Conclusions

• A MAC layer monitoring tool is required• A proof-of-concept monitoring tool is implemented• Such tools can be easily integrated with existing monitoring systems (Konark)

33

Future Directions

• Cost efficient ways of monitoring MAC layer need to be determined• Efficient methodologies for building intrusion detection systems for thin clients are required• Ajanta agents need to be customized to run on handhelds and wearable computers