AirMagnet PRG-Laptop 7.0, Reference Manual, Page: 61 / 210

AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 2: IDS—Denial of Service Attack 53
The IEEE 802.1X specification prohibits a client to bring up its
interface when the required mutual authentication has not been
completed. This enables a well implemented 802.1x client station to
avoid being fooled by a fake AP sending premature EAP-Success
packets to bypass mutual authentication.
An attacker could keep the client interface from coming up (therefore
DoS) by continuously spoofing pre-mature EAP-Failure frames from
the AP to the client to disrupt the authentication state on the client as
explained in the previous paragraph.
AirMagnet
Mobile
detects this form of DoS attack by tracking the
spoofed pre-mature EAP-Failure frames and the 802.1x
authentication states for each client station and AP. Locate the device
and take appropriate steps to remove it from the wireless
environment.
Figure 2-22: Locating a device using AirMagnet Mobile FIND tool
Laptop Wireless LAN Policy Reference Guide.book Page 53 Thursday, January 25, 2007 5:36 PM