Case Study: The WIDS Containment Effect Is Poor
Symptom
After WIDS is enabled, the rogue device containment effect is poor. Rogue STAs are not brought offline or can still associate with an AP after being brought offline.
Relevant Alarms and Logs
None
Cause Analysis
Based on the containment mechanism of WIDS, Deauthentication packets are sent to intervene with rogue APs and STAs so that they cannot work properly. Therefore, the containment effect is closely related to the capabilities of rogue APs and STAs.
For example, if the PMF function is enabled on rogue hotspots or some wireless hotspots dynamically switch BSSIDs, the containment effect cannot be achieved. Additionally, if a contained rogue STA can initiate a re-association request immediately after being disconnected, the containment effect is poor.
In actual tests, it is found that laptops, especially some equipped with high-end network adapters (such as Intel 9 series and Wi-Fi 6 series network adapters), encounter severe packet loss. For mobile phones, the containment effect is much better. Some mobile phones fail to associate with APs.
The containment effect is closely related to the capabilities of contained devices. As such, APs can only send Deauthentication packets to contain rogue devices.
Procedure
- Use the wireless network adapter of a STA to obtain air interface packets on the corresponding channel, check the Deauthentication packets, and analyze the behavior of the contained device (by checking whether it sends a reassociation request immediately after being contained).