Disrupting connections between rogue access points and rogue stations with spoofed BSS transition management request frames
A Wi-Fi controller identifies a rogue access point from AP scan reports and a rogue station from station scan reports. A connection between the rogue station and the rogue access point is disrupted by notifying a nearby, trusted access point to transmit a spoofed Basic Service Set (BSS) Transition Management Request (BTM-REQ frame) Action frame. In response, the trusted access point generates the frame spoofed with a Preference field value for a rogue BSSID set to a lowest value under a Subelement: BSS Transition Candidate Preference field, and also spoofed having a Preference field value for a trusted BSSID set to a highest value, and further spoofed with the Disassociation Imminent field value is set to 1 indicative of upcoming disconnection.
1 . A computer-implemented method in a Wi-Fi controller on a data communication network, for disrupting connections between rouge access points and rogue stations operating with spoofed Basic Service Set (BSS) Transition Management Request (BTM-REQ frame) Action frames, the method comprising:
receiving, at the Wi-Fi controller, AP scan reports and station scan reports from one or more access points;
identifying a rogue access point from the access point scan reports and a rogue station from the station scan reports, wherein the rogue station and the rogue access point are compatible with IEEE 802.11v;
disrupting the rogue station connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed BTM-REQ Action frame, having a Preference field value for a rogue BSSID set to a lowest value under a Subelement: BSS Transition Candidate Preference field, and having a Preference field value for a trusted BSSID set to a highest value, wherein the Disassociation Imminent field value is set to 1 indicative of upcoming disconnection, and wherein the nearby trusted access point is compatible with IEEE 802.11v; and
detecting disruption of the connection between the rogue station and the rogue BSSID from subsequent station scan reports;
wherein a second rogue station does not support IEEE 802.11v, disrupting the connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed Action frame, wherein a Preference field value is set to a lowest value for a rogue BSSID under Subelement: BSS Transition Candidate Preference, wherein a Preference field value for a trusted BSSID is set to a highest value.
2 . The method of claim 1 , further comprising identifying reconnection to rogue BSSID, and in response, broadcasting the spoofed BTM-REQ Action frame.
3 . The method of claim 1 , further comprising identifying a threshold number of rogue stations connected to the same rogue access point, and in response, broadcasting the spoofed BTM-REQ Action frame, wherein a second rogue station avoids any future connection by the second rogue station to the rogue access point.
4 . The method of claim 1 , further comprising identifying a threshold number of rogue stations potentially connecting to the same rogue access point, and in response, broadcasting the spoofed BTM-REQ Action frame, wherein a second rogue station avoids any future connection by the second rogue station to the rogue access point.
5 . The method of claim 1 , wherein the step of identifying the access point with an OUI comparison.
6 . The method of claim 1 , wherein the BTM-REQ Action frame a Disassociation Time field is set to a relatively low value.
7 . The method of claim 1 , further comprising detecting the rogue station and the rogue access point comprises detecting a Wi-Fi 6E rogue station and a Wi-Fi 6E access point.
8 . The method of claim 1 , wherein the spoofed BTM-REQ Action frame comprises a solicited BTM-REQ Action frame transmitted by the nearby, trusted access point after detecting an IEEE 802.11v frame exchange between the rogue access point and the rogue station.
9 . The method of claim 1 , wherein the spoofed BTM-REQ Action frame comprises an unsolicited BTM-REQ Action frame transmitted by the nearby, trusted access point without first receiving a BTM Query frame from the rogue station.
10 . The method of claim 1 , wherein the Wi-Fi controller selects the nearby, trusted access point based at least in part on a scan report identifying the nearby, trusted access point as being in a vicinity of the rogue access point.
11 . The method of claim 10 , wherein the scan report comprises received signal strength information associated with one or more detected wireless devices.
12 . The method of claim 1 , wherein the spoofed BTM-REQ Action frame is transmitted on an operating channel of the rogue access point.
13 . The method of claim 1 , wherein the spoofed BTM-REQ Action frame comprises a BSS Transition Candidate Preference subelement that identifies the rogue BSSID with a preference value of zero.
14 . The method of claim 1 , wherein the spoofed BTM-REQ Action frame comprises a BSS Transition Candidate Preference subelement that identifies the trusted BSSID with a preference value of 255.
15 . The method of claim 1 , wherein the Wi-Fi controller causes a WIDS radio of the nearby, trusted access point to transmit the spoofed BTM-REQ Action frame while the WIDS radio is operating in a dedicated monitor mode.
16 . The method of claim 1 , wherein the subsequent station scan reports indicate that the rogue station has disconnected from the rogue BSSID or has ceased data traffic through the rogue access point.
17 . The method of claim 1 , wherein disrupting the connection to the rogue access point for the second rogue station comprises causing the nearby, trusted access point to transmit a spoofed IEEE 802.11k Neighbor Report Response frame identifying the rogue BSSID with the lowest value and identifying the trusted BSSID with the highest value.
18 . A non-transitory computer-readable medium in a Wi-Fi controller on a data communication network, for disrupting connections between rouge access points and rogue stations operating with spoofed Basic Service Set (BSS) Transition Management Request (BTM-REQ frame) Action frames, the method comprising:
receiving, at the Wi-Fi controller, AP scan reports and station scan reports from one or more access points;
identifying a rogue access point from the access point scan reports and a rogue station from the station scan reports, wherein the rogue station and the rogue access point are compatible with IEEE 802.11v;
disrupting the rogue station connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed BTM-REQ Action frame, having a Preference field value for a rogue BSSID set to a lowest value under a Subelement: BSS Transition Candidate Preference field, and having a Preference field value for a trusted BSSID set to a highest value, wherein the Disassociation Imminent field value is set to 1 indicative of upcoming disconnection, and wherein the nearby trusted access point is compatible with IEEE 802.11v; and
detecting disruption of the connection between the rogue station and the rogue BSSID from subsequent station scan reports;
wherein a second rogue station does not support IEEE 802.11v, disrupting the connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed Action frame, wherein a Preference field value is set to a lowest value for a rogue BSSID under Subelement: BSS Transition Candidate Preference, wherein a Preference field value for a trusted BSSID is set to a highest value.
19 . A Wi-Fi controller on a data communication network, for disrupting connections between rouge access points and rogue stations operating with spoofed Basic Service Set (BSS) Transition Management Request (BTM-REQ frame) Action frames, the Wi-Fi controller comprising:
a processor;
a network interface communicatively coupled to the processor and to a data communication network; and
a memory, communicatively coupled to the processor and storing:
an access point module to receive AP scan reports and station scan reports from one or more access points;
a rogue device detector to identify a rogue access point from the access point scan reports and a rogue station from the station scan reports, wherein the rogue station and the rogue access point are compatible with IEEE 802.11v; and
a rogue device disruptor to disrupt the rogue station connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed BTM-REQ Action frame, having a Preference field value for a rogue BSSID set to a lowest value under a Subelement: BSS Transition Candidate Preference field, and having a Preference field value for a trusted BSSID set to a highest value, wherein the Disassociation Imminent field value is set to 1 indicative of upcoming disconnection, and wherein the nearby trusted access point is compatible with IEEE 802.11v,
wherein the rogue device detector identifies disruption of the connection between the rogue station and the rogue BSSID from subsequent station scan reports; and
wherein a second rogue station does not support IEEE 802.11v, disrupting the connection to the rogue access point by notifying a nearby, trusted access point to transmit a spoofed Action frame, wherein a Preference field value is set to a lowest value for a rogue BSSID under Subelement: BSS Transition Candidate Preference, wherein a Preference field value for a trusted BSSID is set to a highest value.
20 . The Wi-Fi controller of claim 19 , wherein the spoofed BTM-REQ Action frame comprises a solicited BTM-REQ Action frame transmitted by the nearby, trusted access point after detecting an IEEE 802.11v frame exchange between the rogue access point and the rogue station.