An organization has experienced rogue access points in the past and wants to take actions to mitigate this type of attack. What should this…

Monitor mode, also known as RFMON mode, allows a wireless network interface card (WNIC) to capture all wireless traffic within its range, not just the traffic addressed to it. This is the fundamental mechanism used by Wireless Intrusion Detection Systems (WIDS) and network administrators to detect rogue access points. By scanning the airwaves and analyzing beacon frames from all broadcasting APs, the system can compare the detected APs against a whitelist of authorized devices. Any AP not on the list is flagged as a potential rogue, allowing for investigation and removal.

A. Require complex passwords: This strengthens authentication for legitimate network access but does not prevent an unauthorized device from being physically connected to the network and broadcasting.

C. Use server-side validation: While crucial for authenticating legitimate users and devices (e.g., via RADIUS/802.1X), it does not actively scan the radio frequency spectrum to discover unauthorized APs.

D. Disallow ICMP packets on the firewall: This is a network hardening technique to limit reconnaissance (like ping sweeps) and has no direct impact on detecting or preventing rogue wireless access points.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-153

Guidelines for Securing Wireless Local Area Networks (WLANs).

Section 3.2.1

"Rogue Access Points

" p. 16: This section states

"Rogue APs are typically detected by continuously monitoring the wireless medium for unauthorized devices." This continuous monitoring is achieved by placing wireless sensors or APs into a scanning or monitor mode to capture all nearby wireless frames.

2. Cisco. (2023). Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

IOS XE Dublin 17.12.x - Security Configuration Guide.

Chapter: "Configuring Rogue Detection and Management": The guide explains that Cisco APs can operate in different modes

including monitor mode

specifically to listen on all channels to detect rogue devices

interference

and intrusion attempts. It details how APs perform "off-channel scanning

" which is a functional application of monitor mode principles to discover unauthorized APs.

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7.3

"WiFi: 802.11 Wireless LANs": In the security subsection

the text discusses threats to wireless networks

including rogue access points. The countermeasures described involve Wireless Intrusion Detection Systems (WIDS)

which operate by scanning 802.11 channels to identify and report unauthorized APs. This scanning process requires the ability to capture all management frames

a function of monitor mode.