CND (312-38) Network Defense Simulation
Network Scenario
You are managing a corporate wireless environment spanning a large manufacturing floor. Suddenly, the help desk receives a flood of tickets from users in "Sector B" stating they have lost all Wi-Fi connectivity. Endpoints report 0% signal strength despite being physically close to an Access Point.
Your Wireless LAN Controller (WLC) indicates that several APs in that sector have unexpectedly gone offline, and your Wireless Intrusion Prevention System (WIPS) triggers critical alerts regarding the RF spectrum.
Traffic & Logs
Question
Which type of wireless network threats an attacker stakes out the area from a nearby location with a high gain amplifier drowning out the legitimate access point?
Think about what happens to legitimate RF communication when a stronger, continuous unreadable signal overpowers the frequency.
Expert Analysis
1. What is happening: An extremely high noise floor (-45 dBm is massive interference) has saturated the 2.4 GHz band on Channel 6. Legitimate devices cannot hear the APs, and APs cannot communicate with the WLC, resulting in a localized denial of service.
2. Identify attack: This is a classic Layer 1 (Physical) DoS attack, specifically an RF Jamming Signal attack.
3. Why correct (B): A jamming signal attack uses a high-gain transmitter to broadcast raw RF noise on the same frequency as the wireless network. Because wireless communication relies on CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance), devices will "listen" to the medium. If the medium is saturated by the jammer's high-gain noise, devices will back off and refuse to transmit, effectively drowning out the legitimate AP.
4. Why others are wrong:
- A. Rogue access point: Involves setting up an unauthorized AP to trick users into connecting (Evil Twin) for MITM, not overwhelming the spectrum with noise.
- C. Ad Hoc Connection: Devices connecting directly to each other without an AP. This bypasses security controls but doesn't drown out the AP.
- D. Unauthorized association: An attacker successfully connecting to the legitimate network. The logs show the medium is unavailable, preventing *any* association.
5. Defensive action: RF Jamming is a physical layer attack, making logical prevention difficult. Defenders must rely on WIPS to detect anomalous noise floors. Mitigation involves Radio Resource Management (RRM) to dynamically switch APs to unaffected channels (e.g., forcing a move from 2.4 GHz to 5 GHz), and using physical security (directional antennas, locating the rogue transmitter via signal triangulation) to neutralize the threat.
Mini Lesson: Wireless Intrusion Detection
- The Noise Floor: Normal RF environments have a low noise floor (e.g., -90 dBm). A spike to -45 dBm indicates overwhelming interference.
- Deauth vs. Jamming: Deauthentication attacks spoof logical 802.11 management frames to disconnect users. Jamming blasts physical RF energy to destroy the medium entirely.
- Layer 1 Defense: Because you cannot "firewall" raw RF waves in the air, physical location tracking and dynamic frequency selection are your primary controls.