Monitoring wireless traffic

Distributed wireless monitoring solutions usually feature remote sensors that sit near 802.11 access points or

areas with a no-wireless policy and continually monitor the air and a server appliance or software to analyze wireless traffic. This enables network administrators to develop a profile of all wireless devices within radio range.

AirMagnet Inc.'s appliance, for example, can identify rogue devices by a radio band, Media Access Control address, service set identifier (SSID) and manufacturer. When a rogue device is detected, AirMagnet's appliances can block it directly, perform a trace from the wired network to locate it, and disable it with a handheld device or by reconfiguring the existing network infrastructure to turn it off.

Typically, the appliance or software analyzes the traffic collected by the sensors in real time to identify rogue wireless local-area networks, detect intruders and attacks, enforce network security policies and monitor the network's health. A signature-based engine, for example, compares traffic characteristics to those of known intrusion attempts or attacks. A separate engine may be used to monitor usage of specific access points or to ensure that agency policies are being followed.

Handheld analyzers use Microsoft Corp.'s Pocket PC operating system or a Linux-based operating system to receive wireless traffic from access points and clients. For example, Fluke Networks Inc.'s WaveRunner gathers information from wireless traffic as the user moves and displays information, including a list of wireless devices, access points, SSIDs and associated clients, and channel-activity traffic analysis.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.