WLAN Discovery Techniques and Intrusion and Attack Techniques
Passive versus active discovery
Passive discovery places a radio in monitor (RFMON) mode and listens to every 802.11 frame - beacons, probe responses, association exchanges - without transmitting. It is invisible to the network, exposes management frames a normal client never sees, and is the foundation of WIPS classification. Active discovery transmits: probe requests, association attempts, or full connection attempts. It is faster and can reveal hidden SSIDs and security settings, but it is detectable and disturbs production traffic.
A frequent trap is confusing monitor mode with promiscuous mode. Promiscuous mode merely stops the card discarding frames not addressed to it, on its current channel after association; monitor mode delivers raw frames with the full 802.11 header plus radio metadata.
Attack families
- Confidentiality: WEP cracking (FMS, PTW, chopchop, ARP replay), WPA/WPA2 handshake or PMKID capture for offline dictionary attack, WPS PIN brute force.
- Authentication/integrity: evil twin, Karma responder, AP MAC spoofing, EAP downgrade, rogue RADIUS.
- Availability: deauthentication and disassociation floods, authentication and association floods, beacon flood, probe-request flood, NAV/CTS abuse.
- Reconnaissance: war driving and beacon analysis to profile vendors, firmware and security suites.
Rule of thumb
Anything requiring the attacker to join the BSS - handshake capture, WPS, EAP relay - is active. Anything derivable from beacons alone (SSID, BSSID, OUI, security suite) is passive, which is why WIPS sensors never need to associate to catch a rogue AP.