Wireless Network Forensics

Forensics capabilities are more of a universal tool for wireless network administrators than limited to management capability. They are needed for two primary reasons. First, the IT staff is stretched very thin, so it may take hours or days to investigate an issue or security incident. If administrators don’t have the right tools to troubleshoot, they are left guessing what the problem was. Second, wireless technologies are fundamentally dynamic and the environment is constantly changing. Being able to rewind time and look back at the state of the environment historically is an important asset to tackle the tricky wireless problems.

The forensic toolset is equally useful for troubleshooting and security purposes but is used in very different ways depending on the role of the administrator. For troubleshooting, as you mentioned, capacity planning is a very common use. But we also see administrators using it frequently to identify intermittent interference issues. From a security prospective, it is often used to help understand the exposure that results from a security incident.

To better understand differences between wireless forensics and wireless IDS, it might help to consider how these two differ in the wired world.

In the wired world, network forensics appliances passively capture and index all traffic so that this complete historical record can be easily consulted and searched in the future for many different reasons, including post-incident investigation, deeper situational awareness and compliance reporting. Currently, we're seeing growing integration between wired IDS and SIEM systems and wired network forensics systems, letting operators click on an IDS alert to drill right into relevant forensics data - for example, pivoting through traffic exchanged by affected systems right before/after an event, making it easy to eyeball not just raw packets but reconstructed sessions and documents.

It's easy to see how this extends to the wireless world - Nathan gave some great examples here of rogue post-incident investigation. But wired forensics data, once recorded, can support many different tasks, such as searching for insider acceptable use policy violations, looking back for leakage (extrusion) of sensitive documents and data, re-running old traffic against newly-installed IDS signatures to see if any intrusions slipped through, etc. I'd be interested in hearing whether these kinds of activities are also supported by wireless network forensics and if so, how.

This is a great question. Performing trend analysis is a key aspect of how forensics is used. By using forensics to understand the baseline behavior for an environment, it becomes much easier to see what is abnormal. Looking at the traffic patterns for the device over time can help identify if the same attack is being launched repeatedly against the infrastructure. We also see forensics being helpful in understanding the sequence of attack and day zero attack analysis. The building blocks for many of the 802.11 attacks are very similar so it’s always interesting to look at exactly what happened over time and how the attack escalated.

1.  Wireless client association data, including what AP it connected to, roaming history and how much data was uploaded and downloaded from each AP
2.  Client and AP signal strength
3.  Authentication and encryption methods the device has used
4.  Traffic details, including traffic flow information about the transmit and receive volumes of unicast, multicast and broadcast data; 802.11 frame subtype and utilized data rates
5.  Retry and CRC percentage information

With such a wealth of data, the options are endless. We see customers continuing to find new purposes and innovative uses for it. The data is presented to the user in an interactive graphical format. This provides the administrator a simple way to work through the volume of data and get to meaningful, actionable information.

Some details about the wireless infrastructure such as CPU or memory utilization can only be captured via network polls. This information is not available in the airspace as is much of the other data captured. Infrastructure polls bring a very complementary set of data to what is captured from the airspace. By bringing it together, we are able to offer a more comprehensive picture of the network to aid in troubleshooting and management tasks.