Q: How do I protect my wireless LAN from RF-related attacks?
Q: How do I protect my wireless LAN from radio-frequency-related attacks?
– Jae, San Jose
A: Because 802.11 networks operate over unlicensed spectrums, they inherently are open to RF-layer attacks.
There are many ways a WLAN can be attacked at the RF layer. One troublesome problem is a denial-of-service attack, where excessive amounts of traffic interfere with normal network operations. Quite often, this type of attack originates with a malicious user. Other times, however, this type of problem is inadvertent. For example, a user might innocently bring a 2.4 GHz cordless phone to work, not realizing that it may wreak havoc on all neighboring 802.11b access points.
To protect against RF-layer threats, you should understand the many different things that might cause them. The following are some common examples:
• RF devices, such as microwaves, cordless phones or Bluetooth clients, operating on the same frequency as your 802.11 WLAN.
• An RF jammer creating a high level of interference in various bands.
• A hacker that is flooding 802.11 channels with unnecessary packets.
• A neighboring access point, potentially outside of your control, creating co-channel interference.
The first crucial step in protecting your WLAN against RF-layer attacks is detection. A good WLAN system will be able to recognize interference and/or excessive load, which may indicate a possible attack. Some WLAN infrastructures exist that provide air monitoring and traffic-forwarding capabilities in a single access point. These provide detection without requiring additional investments in WLAN infrastructure.
After detection, a system should adjust RF characteristics to correct any perceived problems. For example, if a Bluetooth device or a neighboring Starbucks WLAN is causing interference, you should be able to adjust transmit power to the access points, alter channel assignments, and tweak other RF parameters to effectively avoid the interference source.
Some issues cannot be remedied completely by the system. An RF jammer that is causing interference on all 2.4 GHz bands is impossible to avoid, for example. If the system can detect the problem, though, an administrator can be notifed to take appropriate actions.
