Threat Detection, Monitoring, and Incident Response
Detection surfaces
Wireless intrusion detection/prevention (WIDS/WIPS) classifies rogues: rogue AP (on your wired network), neighbor AP (nearby, not yours), honeypot/evil twin (impersonating your SSID), and misconfigured APs. Containment (deauth-based) is legally and operationally sensitive; know when it is appropriate. Wired threats include ARP spoofing, DHCP starvation, MAC flooding, and unauthorized devices.
Monitoring
Telemetry flows from controllers, APs, switches, and ClearPass into a management/monitoring platform. Distinguish syslog (events) from SNMP polling (state) from flow data (traffic behavior). Baselines matter: alerting without a baseline produces noise. Understand that log integrity and time synchronization (NTP) are prerequisites for correlation.
Incident response
Follow prepare, detect, contain, eradicate, recover, and lessons-learned. Preserve evidence before containment actions that destroy state. Document scope and timeline.
Traps
- Labeling any unknown SSID a rogue; classification depends on whether it is on your wire.
- Assuming containment is always the right first action - it can disrupt clients and may have regulatory implications.
- Confusing detection with prevention; WIPS requires sensors and policy.
Worked example
An AP broadcasting your SSID with a different BSSID and no wired presence is likely an evil twin. First confirm classification from the management platform, then decide containment versus investigation, and preserve logs.