This simulation focuses on wireless network security and physical layer signaling. As a Network Defender, understanding how wireless data is modulated and spread across frequencies is vital for tuning Wireless Intrusion Prevention Systems (WIPS), identifying rogue access points, and mitigating jamming or interception attacks.
CND (312-38) Network Defense Simulation
Network Scenario
You are investigating a potential rogue Access Point (AP) in your corporate facility. Your WIPS (Wireless Intrusion Prevention System) has flagged anomalous RF (Radio Frequency) activity in the 2.4 GHz band. The sensor logs indicate the presence of a legacy physical layer (PHY) modulation scheme being used to broadcast a hidden SSID. To correctly classify the threat and understand the attacker's transmission method, you need to analyze the specific spread spectrum technique identified by the sensors.
Traffic & Logs
[RF_SENSOR_04]: Frequency Band: 2.412 GHz (Channel 1)
[MODULATION_ANALYSIS]: PHY Type detected: 802.11b compatible.
[SIGNAL_PROPERTIES]: Baseband signal multiplied by Barker code (11-chip pseudo-random noise sequence).
[THREAT_LEVEL]: LOW (Legacy fallback detected, possible misconfiguration or rogue device)
[ACTION]: Logging MAC address and calculating RSSI triangulation...
Question
Identify the spread spectrum technique that multiplies the original data signal with a pseudo random noise spreading code.
Look at the WIPS logs. The signal is multiplied by a "pseudo-random noise sequence" (like a Barker code). This direct multiplication spreads the signal across a wider frequency band.
Expert Analysis
1. Network Context: The WIPS has detected wireless traffic using an older 802.11b physical layer standard. Defenders monitor physical layer characteristics to identify outdated, vulnerable wireless devices (which attackers often deploy as rogue APs) operating within the corporate airspace.
2. Identifying Behavior: The sensor specifically notes the data signal is multiplied by an 11-chip pseudo-random noise (PN) sequence (Barker code). This is a physical layer modulation signature.
3. Why C is Correct: DSSS (Direct-Sequence Spread Spectrum) is the technique that takes the original data signal and multiplies it with a pseudo-random noise spreading code (chipping code). This spreads the signal across a wider frequency band, making it more resistant to narrow-band interference and jamming. It is a defining characteristic of early Wi-Fi standards like 802.11b.
4. Why Others are Wrong:
- ISM (Industrial, Scientific, and Medical): This is a set of radio bands (e.g., 2.4 GHz, 5 GHz) reserved internationally, not a spread spectrum technique.
- FHSS (Frequency-Hopping Spread Spectrum): This technique spreads the signal by rapidly switching the carrier among many frequency channels, rather than multiplying the data with a PN code.
- OFDM (Orthogonal Frequency-Division Multiplexing): This technique splits the signal into multiple smaller sub-signals transmitted simultaneously at different frequencies. It does not use PN codes for spreading and is used in modern Wi-Fi (802.11a/g/n/ac/ax).
5. Defensive Action: Upon detecting unauthorized DSSS signals (indicating legacy 802.11b networks), the defender should use the WIPS to triangulate the rogue AP's physical location. Legacy protocols lack modern security controls (like WPA3), making them prime entry points for attackers. The AP must be physically removed or isolated at the switch port level.
• DSSS Resilience: The PN code used in DSSS allows the receiver to filter out ambient noise. If an attacker tries a narrow-band jamming attack, DSSS can often recover the signal.
• WIPS Signaturing: Advanced WIPS don't just look at MAC addresses; they analyze RF modulation. An attacker spoofing a modern AP's MAC address but using DSSS modulation will immediately trigger an anomaly alert because the PHY layer behavior doesn't match the expected hardware profile.