Most WLAN interference is accidenta

Most WLAN interference is accidental. While an
attacker could use a high-powered RF signal
generator to "jam" transmissions, there are many
less expensive ways to intentionally DoS your
WLAN. For example: 802.11 Control frames can be used to "busy out"
a channel so that no other station can transmit.
Entering this continuous transmit mode is known
as a Queensland DoS attack. 802.11 Deauthenticate frames can be used to
disconnect an individual station, or every station
associated with a given AP. Sending a continuous
stream of these forged frames is known as a
Deauth Flood. 802.11 Associate frames consume AP resources
by creating entries in the AP's association table.
Flooding an AP with Associate frames from
random station MAC addresses can make the AP
too busy to service real users. Similar attacks can be launched using forged
802.1X packets -- for example, 802.1X EAP
Logoff Flood, EAP Start Flood, and EAP-of-Death
attacks. Spoofed Block Acknowledgement control frames
can be used to disrupt high-throughput multimedia
streams in WLANs that use this new 802.11n
feature. These and many other wireless DoS attacks are
possible because only 802.11 data frames can carry
cryptographic integrity check or authentication
codes used to detect forged messages. These
attacks can be launched using off-the-shelf wireless
cards and readily-available shareware or open source tools, like airereplay and void11. The
attacker just needs to be close enough to your
WLAN to capture a little traffic to identify victims. Fortunately, most WIPS can recognize these DoS
attack signatures. A WIPS can alert you to 802.11
or 802.1X floods, based on configured rate
thresholds. A WIPS can also help you establish a
performance baseline for your WLAN, so that you
can tune attack thresholds. For example, an Associate Flood alert will be generated when a
specific AP receives more than N Associates per
minute, when N depends on the normal user
behavior for your network. In addition, a WIPS can help you spot emerging
attack patterns. For example, an attacker may
precede an Evil Twin attack with a Deauth Flood. A WIPS can help you link these two attacks. An
attacker may move from AP to AP, performing
similar attacks, from different MAC addresses. A
WIPS can help you spot this behavior, generating
an escalated alert that draws more immediate
attention to the attack in progress. Without a WIPS, some DoS attacks might be chalked up to
intermittent performance problems. A WIPS gives
you the ability to look back to see whether
suspicious or known activity occurred around the
time a WLAN failure was reported. For immediate investigation of an attack on a
remote site, put a WIPS agent (i.e., an AP assigned
to operate in full-time WIPS mode or a dedicated
sensor) into capture mode. By capturing the attack
in progress, you can determine affected systems
and gather evidence to support disciplinary or legal actions. You may also want to put MAC addresses
involved in past attacks on a "watch list" so that
high priority alerts can prompt fast action if and
when the attacker returns. Some WIPS even
implement anti-DoS "strike back" actions that can
be automatically invoked to reduce the severity or duration of a detected DoS attack. As with interference, a WIPS can help you
physically locate DoS attack sources. However,
malicious attackers may not stick around long, so
on-site searches may prove futile unless conducted
quickly. Furthermore, decide in advance whether
search staff should attempt to identify the culprit, issue a warning, call security, etc. Remember, the
attacker may be operating from a public area, like a
nearby parking lot, where you really have no
authority. Conclusion These measures can be helpful to spot, diagnose,
and respond to radio interference and DoS attacks.
But none of these steps can completely insulate
your WLAN. If wireless is critical to your business, create a fallback plan. Wired networks routinely
employ high-availability measures like link diversity,
redundant routers, and uninterruptible power
supplies. Apply this thinking to your WLAN as well
by taking advantage of standard RF interference
avoidance techniques like Dynamic Frequency Selection (DFS) and considering where, when, and
how wired alternatives would be applied when all
wireless remedies have been exhausted.

Results (Vietnamese) 1:

Most WLAN interference is accidental. While anattacker could use a high-powered RF signalgenerator to "jam" transmissions, there are manyless expensive ways to intentionally DoS yourWLAN. For example: 802.11 Control frames can be used to "busy out"a channel so that no other station can transmit.Entering this continuous transmit mode is knownas a Queensland DoS attack. 802.11 Deauthenticate frames can be used todisconnect an individual station, or every stationassociated with a given AP. Sending a continuousstream of these forged frames is known as aDeauth Flood. 802.11 Associate frames consume AP resourcesby creating entries in the AP's association table.Flooding an AP with Associate frames fromrandom station MAC addresses can make the APtoo busy to service real users. Similar attacks can be launched using forged802.1X packets -- for example, 802.1X EAPLogoff Flood, EAP Start Flood, and EAP-of-Deathattacks. Spoofed Block Acknowledgement control framescan be used to disrupt high-throughput multimediastreams in WLANs that use this new 802.11nfeature. These and many other wireless DoS attacks arepossible because only 802.11 data frames can carrycryptographic integrity check or authenticationcodes used to detect forged messages. Theseattacks can be launched using off-the-shelf wirelesscards and readily-available shareware or open source tools, like airereplay and void11. Theattacker just needs to be close enough to yourWLAN to capture a little traffic to identify victims. Fortunately, most WIPS can recognize these DoSattack signatures. A WIPS can alert you to 802.11or 802.1X floods, based on configured ratethresholds. A WIPS can also help you establish aperformance baseline for your WLAN, so that youcan tune attack thresholds. For example, an Associate Flood alert will be generated when aspecific AP receives more than N Associates perminute, when N depends on the normal userbehavior for your network. In addition, a WIPS can help you spot emergingattack patterns. For example, an attacker mayprecede an Evil Twin attack with a Deauth Flood. A WIPS can help you link these two attacks. Anattacker may move from AP to AP, performingsimilar attacks, from different MAC addresses. AWIPS can help you spot this behavior, generatingan escalated alert that draws more immediateattention to the attack in progress. Without a WIPS, some DoS attacks might be chalked up tointermittent performance problems. A WIPS givesyou the ability to look back to see whethersuspicious or known activity occurred around thetime a WLAN failure was reported. For immediate investigation of an attack on aremote site, put a WIPS agent (i.e., an AP assignedto operate in full-time WIPS mode or a dedicatedsensor) into capture mode. By capturing the attackin progress, you can determine affected systemsand gather evidence to support disciplinary or legal actions. You may also want to put MAC addressestham gia vào cuộc tấn công qua trên một danh sách xem"" vì vậy màưu tiên cảnh báo có thể nhắc hành động nhanh chóng nếu vàKhi những kẻ tấn công trở lại. Một số thậm chí WIPSthực hiện hành động chống DoS "tấn công trở lại" có thểđược tự động kích hoạt để giảm mức độ nghiêm trọng hoặc thời gian của một cuộc tấn công DoS được phát hiện. Như với sự can thiệp, một WIPS có thể giúp bạncơ thể xác định vị trí DoS tấn công nguồn. Tuy nhiên,kẻ tấn công độc hại có thể không dính khoảng dài, vì vậyTìm kiếm ngay trong khuôn viên có thể chứng minh vô ích trừ khi thực hiệnmột cách nhanh chóng. Hơn nữa, quyết định trước cho dùTìm nhân viên nên cố gắng để xác định thủ phạm, phát hành một cảnh báo, gọi an ninh, vv. Hãy nhớ rằng, cáckẻ tấn công có thể hoạt động từ một khu vực, như mộtnhiều bãi đậu xe gần đó, nơi mà bạn thực sự không cóthẩm quyền. Kết luận những biện pháp này có thể hữu ích để phát hiện, chẩn đoán,và đáp ứng với sự can thiệp của đài phát thanh và cuộc tấn công DoS.Nhưng không ai trong số các bước sau có thể hoàn toàn cách nhiệtWLAN của bạn. Nếu không dây là rất quan trọng để doanh nghiệp của bạn, tạo ra một kế hoạch dự phòng. Dây mạng thường xuyênsử dụng các biện pháp sẵn sàng cao thích liên kết đa dạng,bộ định tuyến dự phòng, và điện liên tụcnguồn cung cấp. Áp dụng tư duy này cho mạng WLAN của bạnbởi lấy lợi thế của tiêu chuẩn RF can thiệptránh kỹ thuật như lựa chọn tần số năng động (DFS) và xem xét ở đâu, khi nào, vàlàm thế nào lựa chọn thay thế dây nào áp dụng khi tất cảbiện pháp khắc phục không dây đã bị kiệt sức.