Understanding Radio Frequency Monitoring

The following section provides an overview of the RF Monitoring feature and contains the following subsections:

•	What is RF Monitoring?

•	Management Interface Overview

What is RF Monitoring?

Radio Frequency (RF) technology used in today’s 802.11-based wireless networking devices poses an attractive target for intruders. If left un-managed, RF devices can leave your wireless (and wired) network open to a variety of outside threats, from Denial of Service (DoS) to network security breaches.

In order to help secure your SonicPoint Wireless Access Point (AP) stations, SonicWALL takes a closer look at these threats. By using direct RF monitoring, SonicWALL helps detect threats without interrupting the current operation of your wireless or wired network.

SonicWALL RF Monitoring provides real-time threat monitoring and management of SonicPoint radio frequency traffic. In addition to its real-time threat monitoring capabilities, SonicWALL RF monitoring provides network administrators a system for centralized collection of RF threats and traffic statistics; offering a way to easily manage RF capabilities directly from the Dell SonicWALL security appliance gateway

SonicWALL RF monitoring is:

•	Real-Time - View logged information as it happens

•	Transparent - No need to halt legitimate network traffic when managing threats

•	Comprehensive - Provides detection of many types of RF threats. For complete descriptions of the above types of RF Threat Detection, see Practical RF Monitoring Field Applications .

Management Interface Overview

The SonicPoint > RF Monitoring management interface provides a central location for selecting RF signature types, viewing discovered RF threat stations, and adding discovered threat stations to a watch list. This section describes the components of the SonicPoint > RF Monitoring page.

 

Table 21. RF Monitoring components

Name	Description
Action Items	Provides the options to accept, cancel, refresh, and clear the RF Monitoring page. See Action Items .
RF Monitoring Summary Panel	Displays the SonicPoint RF Monitoring units, total RF threats, and measurement interval (using seconds as the unit of measurement). See RF Monitoring Summary .
802.11 General Frame Setting	Displays the amount of total general threats and the option to enable long duration. See 802.11 General Frame Setting .
802.11 Management Frame Setting	Configures your management frame settings and displays the number of threats for each setting. See 802.11 Management Fame Setting .
802.11 Data Frame Setting	Configures your data frame settings and displays the number of threats for each setting. See 802.11 Data Frame Setting .
Discovered RF Threat Stations	Displays information about either all discovered RF threat stations or only those on the Watch List Group. See Discovered RF Threat Stations .

Action Items

 

Table 22. Action-item buttons

Name	Description
Accept Button	Accepts the latest configuration settings.
Cancel Button	Cancels any changed RF Monitoring settings.
Refresh Button	Refreshes the SonicPoint > RF Monitoring page.
Clear Button	Clears all the configured settings and returns the page back to the default settings.

RF Monitoring Summary

 

Table 23. RF Monitoring summary components

Name	Description
SonicPoint RF Monitoring Units	Displays the total number of SonicPoint appliances.
Total RF Threats	Displays the total number of RF threats.
Measurement Interval (Seconds)	Enter the desired measurement interval in seconds.

802.11 General Frame Setting

 

Table 24. 802.11 General Frame setting

Name	Description
Total General Threats	Displays the total number of general threats.
Long Duration	Wireless devices share airwaves by dividing the RF spectrum into 14 staggered channels. Each device reserves a channel for a specified (short) duration and during the time that any one device has a channel reserved, other devices know not to broadcast on this channel. Long Duration attacks exploit this process by reserving many RF channels for very long durations, effectively stopping legitimate wireless traffic from finding an open broadcast channel.

802.11 Management Fame Setting

Clicking the checkboxes enables/disables the following monitors:

 

Table 25. 802.11 Management Frame setting

Name	Description
Total Management Threats	Displays the total number of management threats.
Management Frame Flood	This variation on the DoS attack attempts to flood wireless access points with management frames (such as association or authentication requests) filling the management table with bogus requests.
Null Probe Response	When a wireless client sends out a probe request, the attacker sends back a response with a Null SSID. This response causes many popular wireless cards and devices to stop responding.
Broadcasting De-authentication	This DoS variation sends a flood of spoofed de-authentication frames to wireless clients, forcing them to constantly de-authenticate and subsequently re-authenticate with an access point.
Valid Station With Invalid SSID	In this attack, a rouge access point attempts to broadcast a trusted station ID (ESSID). Although the BSSID is often invalid, the station can still appear to clients as though it is a trusted access point. The goal of this attack is often to gain authentication information from a trusted client.
Wellenreiter Detection	Wellenreiter and NetStumbler are two popular software applications used by attackers to retrieve information from surrounding wireless networks.
Ad-Hoc Station Detection	Ad-Hoc stations are nodes which provide access to wireless clients by acting as a bridge between the actual access point and the user. Wireless users are often tricked into connecting to an Ad-Hoc station instead of the actual access point, as they may have the same SSID. This allows the Ad-Hoc station to intercept any wireless traffic that connected clients send to or receive from the access point.

802.11 Data Frame Setting

Clicking the checkboxes enables/disables the following monitors.

 

Table 26. 802.11 Data Frame setting

Name	Description
Total Data Threats	Displays the total number of data threats.
Unassociated Station	A wireless station attempts to authenticate prior to associating with an access point, the unassociated station can create a DoS by sending a flood of authentication requests to the access point while still unassociated.
NetStumbler Detection	Typically is used to locate both free Internet access as well as interesting networks. Netstumbler interfaces with a GPS receiver and mapping software to automatically map out locations of wireless networks.
EAPOL Packet Flood	Extensible Authentication Protocol over LAN (EAPOL) packets are used in WPA and WPA2 authentication mechanisms. Since these packets, like other authentication request packets, are received openly by wireless access points, a flood of these packets can result in DoS to your wireless network.
Weak WEP IV	WEP security mechanism uses your WEP key along with a randomly chosen 24-bit number known as an Initialization Vector (IV) to encrypt data. Network attackers often target this type of encryption because some of the random IV numbers are weaker than others, making it easier to decrypt your WEP key.

Discovered RF Threat Stations

 

Table 27. Discovered RF Threat Stations table

Name	Description
Items	Displays the total number of logged threats. Use the arrow buttons to navigate through pages if applicable.
Station	Selects the type of stations displayed in the list of entries.
# MAC Address	Sorts the entries by MAC Address. This is the physical address of the RF threat station.
Type	Sorts the entries by the type of wireless signal received from the threat station.
Vendor	Sorts the entries by vendor. This is the manufacturer of the threat station (determined by MAC address).
RSSI	Sorts the entries by the received signal strength as reported by the SonicPoint. This entry, along with the Sensor entry, can be helpful in triangulating the actual physical position of the RF threat device.
Rate	Sorts the entries by transfer rate (Mbps) of the threat station.
Encrypt	Sorts the entries by wireless signal encryption on the threat station, None, or Encrypted.
RF Threat	Sorts the entries by RF threat (occurs in the latest time).
Update Time	Sorts the entries by the time this log record was created/updated.
Sensor	Sorts the entries by the ID of the SonicPoint which recorded this threat. This entry, along with the Rssi entry, can be helpful in triangulating the actual physical position of the RF threat device.
Comment	Displays a text box to add comments about the threat.
Configure	Configures a watch list for discovered stations.

TIP: It is possible to find approximate locations of RF Threat devices by using logged threat statistics. For more practical tips and information on using the RF Management threat statistics, see Practical RF Monitoring Field Applications