Wireless Intrusion Prevention Systems (WIPS) Implementation
Architecture
A WIPS is an overlay of sensors (or APs with a dedicated monitor radio) feeding an engine that correlates, classifies, alerts, and optionally contains. A sensor scans one channel at a time, so coverage planning must account for dwell time; 2.4 GHz needs denser placement than 5 GHz because of co-channel overlap. Distributed designs classify at the sensor; centralized designs classify in the engine. Spectrum analysis adds non-802.11 interference detection that a pure WIPS misses.
Classification and containment
Every detected device lands in a bucket: authorized (inventory/whitelist), neighbor or known (other legitimate networks), rogue (SSID on the wired network or impersonating yours), or interfering (any other radio). Wireless containment floods spoofed deauthentication frames at the rogue; wired containment disables the switch port through SNMP, port suppression, or an 802.1X change of authorization. Both depend entirely on correct classification.
Traps
Automatic containment without a maintained whitelist turns the WIPS into a self-inflicted denial-of-service weapon - an attacker can spoof an authorized BSSID and provoke the system. Matching on SSID alone is insufficient; compare BSSID, OUI, security configuration and channel. A WIPS cannot see wired-only threats, and an AP that scans while serving clients loses service time unless it has a second radio.
Rule of thumb
Detect equals passive monitoring plus signature and behavior analysis; prevent equals containment, which must be whitelisted, scheduled and logged. Before answering, decide whether the question asks for detection or prevention - the correct option differs.