topic RE: Wing 5.9. WIPS events explanation in ExtremeWireless (WiNG)

Wing 5.9. WIPS events explanation

Tim_Taller — Tue, 25 Sep 2018 19:13:00 GMT

Hello.

I have just installed AP6532 (Wing 5.9). Made simple setup and enable WIPS.

In WIPS events I see event name "unencrypted-wired-leakage".

What does it means ?

Is there some guide according to WIPS ?

Thanks.

RE: Wing 5.9. WIPS events explanation

ckelly — Tue, 25 Sep 2018 19:55:00 GMT

Tim, I don't think that a description exist for the WiNG WIPS alarms (that I can locate right now) but AirDefense contains essentially the same alarm and does have an explanation. Here is it's explanation:

An access point is detected leaking wired traffic into the air. This indicates that the AP is not employing an encryption mechanism for multicast or broadcast traffic that originates from the wired side of the network. Multicast and broadcast traffic perform important functions that are vital for network discovery and content delivery. Since an access point acts as a bridge between the wired and the wireless medium, the AP will transmit this multicast and broadcast traffic into the air. In a typical corporate network, this data that is wirelessly transmitted should be encrypted by the AP to prevent it from being read by wireless eavesdroppers. If this multicast and broadcast traffic is not encrypted by the AP, then all layer 3 and above information in these packets will be clearly visible to wireless eavesdroppers.

Using layer 3 and above information, eavesdroppers can begin assembling a representation of the wired network, including routing protocols. In the case of NetBIOS traffic, the eavesdropper can also see devices that are located on the wired network. This type of AP misconfiguration is a security risk because the eavesdropper is able operate in a listen-only mode and may therefore go undetected for extended periods of time. In addition to the primary security concerns of wired side leakage, networks with excessive amounts of broadcast or multicast traffic could also experience a degradation in their wireless network performance due to the frequent multicast transmissions.

RE: Wing 5.9. WIPS events explanation

Tim_Taller — Tue, 25 Sep 2018 21:22:00 GMT

Thank you Chris!

In event string I see "Reporting AP" and "Originating device".

As far as I understood "Originating device" use broadcast traffic ?

How can I setup AP to avoid that ?

Thanks.

RE: Wing 5.9. WIPS events explanation

ckelly — Tue, 25 Sep 2018 21:28:00 GMT

Correct. Reporting AP would be the 'sensor' so to speak - that was responsible for the event being able to be seen. The Originating device should be the 'Offending' device.

RE: Wing 5.9. WIPS events explanation

RobertZ — Tue, 25 Sep 2018 21:35:00 GMT

The below is a WING guide; in it, not much descriptive info for the wips events
REFERENCE GUIDE

RE: Wing 5.9. WIPS events explanation

ckelly — Tue, 25 Sep 2018 21:39:00 GMT

There appears to be *no* description for any of the AP Anomaly events in that doc...

RE: Wing 5.9. WIPS events explanation

Tim_Taller — Wed, 26 Sep 2018 15:25:00 GMT

Yes. There is no WIPS descriptions in Reference Guide.

Chris,
Could you please explain what means event - "wireless-bridge"?

There is a lot of neighbors AP near by in building. Some of them, I guess, bridged between each others.

Is there way to detect bridge to my APs ?

Thanks.

RE: Wing 5.9. WIPS events explanation

ckelly — Wed, 26 Sep 2018 18:06:00 GMT

The description/name of this alert is a little vague, but in the basis sense, a wireless-bridge would be an access point that is wireless connected directly to another access point. If you are seeing this event alert, it should specify the access points in question. The first thing to determine is if any of the APs are 'yours'. If none of the APs are yours, then this alert can be ignored. If any of the APs are yours, you need to confirm that their bridge connection is expected behavior.

RE: Wing 5.9. WIPS events explanation

Tim_Taller — Wed, 26 Sep 2018 22:30:00 GMT

Thanks Chris.