In this simulation, you will analyze wireless reconnaissance techniques used by attackers to map organizational perimeters. Learn to identify the signatures of access point mapping and understand the defensive controls required to secure wireless signals.

CND (312-38) Network Defense Simulation

Network Scenario

The organization operates a suburban campus with several branch offices. The internal network uses a WPA3-Enterprise wireless infrastructure (SSID: Corp_Secure_WiFi).

Physical security reports mention a slow-moving vehicle circling the perimeter multiple times over the last 48 hours. Simultaneously, the Wireless Intrusion Prevention System (WIPS) flagged several "Probe Request" bursts from unidentified MAC addresses originating outside the building line.

Traffic & Logs

# WIPS Alert Log - ID: 4492-W

[2023-10-24 14:22:10] ALERT: High-frequency Probe Requests detected.

[2023-10-24 14:22:11] Source MAC: 00:0C:29:XX:XX:XX (OUI: VMware, Inc.)

[2023-10-24 14:22:11] Targeted SSIDs: [ANY], [Corp_Secure_WiFi], [Guest_Net]

[2023-10-24 14:23:05] Signal Strength observed: -72dBm to -85dBm (fluctuating).

---

# Kismet Log Fragment (External/Simulated)

BSSID: AC:DE:48:00:11:22 | SSID: Corp_Secure_WiFi | CH: 6 | ENC: WPA3 | GPS: 34.0522, -118.2437

BSSID: AC:DE:48:00:11:23 | SSID: Guest_Net | CH: 11 | ENC: OPEN | GPS: 34.0523, -118.2439

Note: The logs show an external entity capturing BSSIDs, SSIDs, and signal strengths correlated with GPS coordinates.

Question

Which of the following techniques is also called access point mapping?

Expert Analysis

1. What is happening in the network

An external entity is performing reconnaissance. By using high-gain antennas and GPS-enabled software (like Kismet or NetStumbler), the attacker is capturing 802.11 beacon frames to identify the location and security parameters of all local wireless networks.

2. Identify attack or behavior

This is War driving. The attacker moves via vehicle to discover as many access points as possible, mapping them by geographic location. This is often the first step in a targeted attack or an attempt to find "shadow IT" or rogue access points with weak security.

3. Why correct answer is correct

War driving is explicitly defined as the act of searching for Wi-Fi networks by a person in a moving vehicle, using a computer or smartphone. This process results in an "Access Point Map," where wireless coverage and security postures are plotted on a geographic map.

4. Why others are wrong

War dialing: A legacy technique using a modem to scan a range of telephone numbers to find active modems or faxes.
Wire tapping: Intercepting signals carried over physical wires (e.g., Ethernet or phone lines).
War flying: While similar to war driving, it specifically uses drones (UAVs) to map access points. While it maps APs, "Access Point Mapping" is most traditionally synonymous with War Driving in technical literature.

MINI LESSON: Wireless Reconnaissance

Traffic Pattern Recognition: Passive scanning (listening for beacons) is invisible to standard network logs. However, Active Scanning (sending Probe Requests to force hidden SSIDs to reveal themselves) can be detected by a WIPS, as seen in the logs above.

Defensive Action: 1. Reduce transmit power to keep signal within the building. 2. Use WPA3-Enterprise. 3. Implement a WIPS to detect rogue APs and active probing. 4. Disable SSID broadcasting (though this only provides minimal security).

Explore more CND simulations