AirDefense can also terminate a connection with an AP or an individual wireless station, and the termination can persist for a specified time or until manually stopped. AirDefense detects intruders by comparing newly detected wireless devices to a list of known devices defined by the administrator. To terminate the activity of an intruding device, AirDefense launches a DoS attack against that device, broadcasting wireless data packets designed specifically to prevent connections from operating properly.
AirDefense's reporting facilities are reasonably extensive. Dozens of built-in report types are defined and arranged in various categories, including Sensors, APs, Stations, Compliance, Network Trends, and Summary Reports. For example, your company might need to comply with the US government's Health Insurance Portability Accountability Act (HIPAA) Security Rule, which requires that some health information transmitted over public networks be encrypted. The built-in HIPAA compliance report can help you quickly identify which wireless stations in your network might be in violation of HIPAA requirements.
One problem that might come up when using AirDefense sensors at remote locations is not enough available bandwidth on your WAN link. The sensors I used for this review required almost all the available bandwidth of a 64Kbps connection to communicate properly with the server. This bandwidth requirement could present problems for companies that have low bandwidth links to any of their remote facilities in which sensors might be deployed. However, by the time you read this review, AirDefense probably will have made available a new version of its sensor OS, which the company says will operate on as little as 3Kbps of bandwidth. The company also says it will release a new version of AirDefense—AirDefense 5.0—sometime before the end of the year.
AirMagnet Distributed 4.0
AirMagnet Distributed 4.0 ships as a software solution with hardware-based sensors. AirMagnet uses the same sensor hardware from the same manufacturer AirDefense does, but each product's sensors run a custom OS. A unique feature of AirMagnet is that it also provides a software-based sensor component that you can load on a Windows-based computer, such as a laptop equipped with a supported wireless network card (e.g., Proxim's ORiNOCO or AirMagnet's own card, which supports 802.11a, 802.11b, and 802.11g). This feature can come in handy in a variety of circumstances in which you might need a mobile sensor.
The server software requires a computer running either Windows XP or Windows 2000. AirMagnet recommends at least a 1.8GHz CPU and 512MB of RAM. Because the AirMagnet management server runs on top of your own installation of Windows, you need to harden the OS against intrusion.
Installing the AirMagnet management server software is straightforward, with a typical wizard to guide the process. The proprietary server software conflicts with IIS, so I had to disable IIS on my test system before installing the management server software. The management server can send its log data to a local standalone database; alternatively, larger installations can integrate with a SQL server.
After the management server was up and running, I could connect to it via a Web browser and download the console software for installation on my desktop system. The AirMagnet console software is a standalone Windows application that communicates with the server for monitoring and configuring sensors and APs. Installation was easy and straightforward. As you can see in Figure 2, the console displays an impressive amount of information. I found it easy to use and navigate.
To configure the sensors, I used a serial connection to define the IP address information, the management server address, and a shared secret key used for communication between the server and sensors. The sensors send their data to the management server, where you can use the console software to review the data. You can also connect to a sensor directly using a Web browser over Secure Sockets Layer (SSL) to examine the sensor's logs (which contain data such as active APs and client station connections), perform diagnostics, and change configuration settings. Unlike AirDefense, AirMagnet can't directly modify AP configuration, but it does interoperate with wireless-network management products such as WaveLink Mobile Manager and AirWave Management Platform via SNMP, and those products can modify AP configurations according to information sent to them from AirMagnet.
AirMagnet includes policies that you can use to detect security problems, and intrusion-detection capabilities that can detect a variety of common wireless network attacks. When AirMagnet detects intrusion attempts or policy violations, it can send alarm alerts in a wide range of formats, including email, SNMP, syslog, Short Message Service (SMS) via email, network phone page, Internet page, Instant Messaging (IM), Windows event log, audio file, and even printer.
AirMagnet can also launch countermeasures to deny service to perceived intruders. Like AirDefense's countermeasures, AirMagnet's countermeasures are essentially DoS attacks broadcast over the airwaves. However, once AirMagnet launches a countermeasure, an administrator must manually deactivate it, and that leaves room for problems—not to mention possible legal retaliation—if an administrator overlooks stopping countermeasure activity.
A nice feature is that AirMagnet can show one list of all APs and wireless client stations for the entire monitored network. This feature is valuable in environments that have many monitored wireless devices because sometimes a graphical map representation of high-density networks can be overly cluttered and hard to read.
Another useful feature of AirMagnet is the ability to automatically escalate problems. The product currently has 98 different alarm types (e.g., for Wi-Fi Protected Access— WPA—vulnerabilities, for changes to APs, for unencrypted traffic). An alarm of any given type can be sent to any number of people, and when the configurable threshold number of a given alarm type is surpassed, AirMagnet can notify additional people.
The AirMagnet Distributed Reporter software includes 50 different report types in four categeories (time-based, site-based, infrastructure-based, and network-based). The reports can be saved in a variety of formats, including HTML, Adobe Acrobat PDF, XML, Microsoft Word, Microsoft Excel, Rich Text Format (RTF), text, and tab separated.
The product comes with a user manual in print and PDF versions. It has built-in online Help too, but AirMagnet's online Help isn't as detailed as AirDefense's.
Register
