Wireless association table denial of service prevention
View Patent ↗Described herein are systems, devices, techniques and products for managing the dynamic assignment of media access control (MAC) addresses to wireless network devices, such as by identifying a dynamically assigned MAC address before, after, or during a wireless association process and communicating the dynamically assigned MAC address to a wireless network device. Also disclosed are systems, devices, techniques and products for preventing a denial of service attack on a wireless access point's association table, such as by requiring devices that associate with a wireless access point to respond to a query from the wireless access point shortly after association.
1. A system comprising:
one or more processors; and
a non-transitory computer readable storage medium coupled to the one or more processors, wherein the non-transitory computer readable storage medium includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
receiving, at a network device, an association request, wherein the association request is related to a wireless client device;
transmitting an association response, wherein the association response includes an association identifier for the wireless client device;
updating an association table with an entry for the wireless client device;
transmitting an association query, wherein receiving the association query at a wireless client device causes the wireless client device to transmit a response to the association query;
monitoring for a response to the association query for a predetermined time period after transmitting the association response;
determining that a response to the association query is not received during the predetermined time period; and
updating the association table to remove the entry for the wireless client device.
2. The system of claim 1 , wherein the association query includes a null data packet, and wherein the response to the association query includes an acknowledgement packet.
3. The system of claim 1 , wherein the association query includes a plurality of null data packets, and wherein the response to the association query includes a plurality of acknowledgement packets.
4. The system of claim 1 , wherein the association query includes an Internet Control Message Protocol echo request message, and wherein the response to the association query includes an Internet Control Message Protocol echo reply message.
5. The system of claim 1 , wherein the association query includes an identification request message, and wherein the response to the association query includes a wireless client identifier.
6. The system of claim 1 , wherein the association query includes a dynamic host configuration protocol (DHCP) offer message, and wherein the response to the association query includes a DHCP request message.
7. The system of claim 1 , wherein determining that a response to the association query is not received during the predetermined time period includes determining that only an incomplete response to the association query is received during the predetermined time period.
8. The system of claim 1 , wherein the association query includes a request for authentication, and wherein the response to the association query includes an authentication credential.
9. The system of claim 1 , wherein the association query includes a request for authentication, wherein the response to the association query includes an authentication credential, and wherein determining that a response to the association query is not received during the predetermined time period includes determining that the wireless client device has not successfully authenticated.
10. The system of claim 1 , wherein the operations further include:
facilitating authentication of the wireless client device after transmitting new association response.
11. The system of claim 1 , wherein the association query and the response to the association query include elements of an IEEE 802.1X authentication process.
12. The system of claim 1 , wherein the association query and the response to the association query include elements of an IEEE 802.11i authentication process.
13. The system of claim 1 , wherein the operations further include:
identifying a media access control (MAC) address included in the association request as different from a hardware MAC address corresponding to the wireless client device.
14. The system of claim 1 , wherein the operations further include:
identifying a media access control (MAC) address included in the association request as a randomly assigned MAC address.
15. The system of claim 1 , wherein the operations further include:
identifying a media access control (MAC) address included in the association request as a randomly assigned MAC address.
16. The system of claim 1 , wherein the operations further include:
identifying a media access control (MAC) address included in the association request as a locally administered MAC address.
17. The system of claim 1 , wherein the operations further include:
identifying a plurality of association requests related to a same wireless client device, wherein each of the plurality of association requests include different media access control (MAC) addresses; and
discarding additional association requests related to the same wireless client device.
18. The system of claim 17 , wherein identifying includes identifying a characteristic related to the plurality of association requests, wherein the characteristic facilitates determining that the plurality of association requests originate from the same wireless client device.
19. A computer implemented method, comprising:
receiving, at a network device, an association request, wherein the association request is related to a wireless client device;
transmitting an association response, wherein the association response includes an association identifier for the wireless client device;
updating an association table with an entry for the wireless client device;
transmitting an association query, wherein receiving the association query at a wireless client device causes the wireless client device to transmit a response to the association query;
monitoring for a response to the association query for a predetermined time period after transmitting the association response;
determining that a response to the association query is not received during the predetermined time period; and
updating the association table to remove the entry for the wireless client device.
20. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
receiving, at a network device, an association request, wherein the association request is related to a wireless client device;
transmitting an association response, wherein the association response includes an association identifier for the wireless client device;
updating an association table with an entry for the wireless client device;
transmitting an association query, wherein receiving the association query at a wireless client device causes the wireless client device to transmit a response to the association query;
monitoring for a response to the association query for a predetermined time period after transmitting the association response;
determining that a response to the association query is not received during the predetermined time period; and
updating the association table to remove the entry for the wireless client device.