hostapd(8) - Wireless Intrusion Detection/Prevention System
  • Rogue accesspoint detection
    • Use a table to define your APs (see last example)
  • Wireless DoS attacks detection
    • i.e., void11 (Reyk Floeter, 2002)
    • rate keyword to detect extensive flooding
    • Imported in 3.8-current
    hostap handle skip type management subtype ! beacon \
        with log \
        rate 100 / 10 sec
            
  • TODO: IEEE 802.11 fingerprinting
  • hostap handle type data os "freebsd-ath-nonfree" \
        with deauth reason unspecified
            
"Proactive Wireless Networks With OpenBSD", BSDCan 2006, Ottawa, Canada, 2006-05-13
Reyk Floeter (reyk@vantronix.net)
.vantronix | secure systems GmbH (http://www.vantronix.net/)