Wireless Intrusion Detection: Finding Rogue APs and Deauth Attacks

Wireless intrusion detection monitors the radio environment for threats that no wired sensor can see. Most enterprise wireless platforms include it, most organizations leave it unconfigured, and the detections it offers are among the cheapest available — the sensors are the access points you already own.

What it detects

Rogue access points. An unauthorized access point connected to your wired network — usually a consumer device someone plugged in for convenience. It bypasses every control on the wired side and advertises a way in from the car park. Detection combines a radio observation with a check of whether the device is actually on your network, because an access point belonging to the business next door is a neighbour rather than a rogue, and systems that cannot tell the difference generate alerts nobody reads.

Evil twins. An access point advertising your network name from a radio identifier that is not yours. This is the one worth alerting on immediately, because it exists to harvest credentials — the attack under evil twin attacks on WPA2-Enterprise.

Deauthentication and disassociation floods. Forged management frames knocking clients off the network, used both as denial of service and to force reconnection to an attacker's access point. Protected management frames, required in WPA3, prevent the forgery, and detecting the attempt is still useful.

Misconfigured and unexpected networks. An access point advertising open or legacy encryption, a network name that should not exist, or a corporate network appearing at a site where it was never deployed.

Ad-hoc and peer connections, and clients bridging between the corporate wireless and another network, which creates a path around the perimeter entirely.

Karma-style responses — an access point that answers every probe request with whatever name the client asked for, which catches devices reconnecting to remembered networks. That client-side leak is described under wardriving and wireless databases.

Detection and containment

Integrated sensing uses production access points, which scan off-channel between serving clients. Cheap, and coverage is partial because the radio is mostly busy doing its actual job.

Dedicated sensors do nothing but listen, giving continuous coverage across all channels. Better detection, additional hardware.

Periodic surveys with a portable analyser still find things fixed sensors miss, particularly in large buildings and at sites with no infrastructure of their own.

Prevention — the P in WIPS — goes further and carries a warning. Containment typically works by transmitting deauthentication frames at the offending access point and its clients, which is deliberately jamming a radio transmission. In several jurisdictions, including under US regulation, interfering with a wireless network you do not own is unlawful, and organizations have been fined substantially for containing guests' personal hotspots.

So configure containment narrowly: only against devices confirmed to be on your own wired network, never against neighbouring networks, and with the legal position checked. Wired-side port shutdown is the safer response to a rogue — find the switch port and disable it, which is decisive, legal and leaves no radio question.

Reducing false positives

The reason these systems get switched off. Neighbouring networks, personal hotspots, and transient devices generate constant observations that are not threats.

Build an authorized list so known-good access points are classified correctly, and tune the rogue definition to require wired-network correlation rather than radio presence alone. Alert on the small number of high-confidence events — an access point advertising your network name that you do not own, a deauth flood, a rogue confirmed on your wired network — and report the rest rather than alerting.

Send those events to your SIEM so they correlate with authentication and endpoint data. A deauth flood followed by a burst of failed enterprise authentications is a far stronger signal than either alone.

The controls underneath

Detection catches what prevention missed, so make sure the prevention is there: WPA3 where clients support it with protected management frames, 802.1X so a rogue access point cannot simply be plugged in and join, and the switch port controls under switch port hardening, which stop an unauthorized device at the wire before its radio matters.

Exam angles

Know a WIDS as monitoring the radio environment for rogue access points, evil twins, deauthentication attacks and misconfigured networks, using integrated or dedicated sensors. Distinguish a rogue — unauthorized and connected to your wired network — from a neighbouring network and from an evil twin impersonating your SSID. Know that WIPS containment transmits deauthentication frames and may be unlawful against networks you do not own, making wired port shutdown the safer response.