1. A Passive Approach to Rogue Access Point Detection IEEE GLOBECOM 2007 Lanier Watkins Raheem Beyah Cherita Corbett 20083150 김진석

2. Contents Introduction Related Works Main Idea Experiment and Result Conclusion Discussion

3. Instruction Rogue AP? ◦Unauthorized AP ◦Produces Security Vulnerabilities ◦Unmonitored Point of Entry (to Private Network) Detection ◦Difficult to Detect ◦Hidden AP (Location and No Broadcasting) ◦No Information from Rogue AP and Offender

4. Instruction RTT? ◦Round Trip Time ◦Time Between Sending Packet and Receiving Response ◦Related Works  Optimization of Protocol for Link Characteristic  RTT in QoS Issue

5. Related Works Wireless vs. Wired Active vs. Passive Wired and Passive Approach!

6. Related Works Wireless vs. Wired ◦Wireless : Using APs, Sensors, Walking the Halls..  Time/Cost Consuming  Detection Time is Limited  Frequency Problem  Sensing Range  Disable the SSID Broadcasting  Low Signal Strength / Directional Antenna

7. Related Works Active vs. Passive ◦Active : Using Queries, New Packets  Network Load Increased  Rogue APs can Ignore Queries ◦Passive : MAC Address, Using Ack-pairs..  MAC Address can be spoofed/cloned  Converging time -> In In-line Deployment?

8. Main Idea Total delay = d prop + d trans + d proc + d queue Total delay = d trans = packetsize / capacity Same Higher-layer Protocol (TCP/IP) d trans -> Characteristic of Physical-Layer

9. Main Idea

10. Experiment Very Simple Testbed No Other Traffic Using Same Laptops for Node

11. Result

12. Result

13. Result

14. Result

15. Conclusion Wireless nodes have greater RTT RTT and Authorized AP Information (Capacity)Wired >> Wireless Result of DCF, Using Variation Wired/Passive!

16. Discussion Limited to TCP/IP (Other Protocols?) Simple Test Bed -> Complex Network Computational Capacity of Nodes Assumption : Wired >> Wireless = True?