DeAuth Packets in Wireless

[Syndacate]

Hey,

I go to a tech college, and recently they installed wireless N AP's in all appts. They work with WPA or WPA2 encryption which uses your personal institute UN/PW to connect.

This all seemed fine and dandy, until the wireless started sucking (only wireless, wired is still fast as hell) - wireless is very slow, for some reason. Whatever, the apartments aren't huge, 4 people / appt with 4 rooms & a living room/kitchen - 1 floor, and me and one of my roommates both have wireless routers (well he turned off DHCP on his, so switch? - whatever you want to call it).

So I started having what I thought was router problems around the same time they activated their new wireless super-network here. This wasn't that outlandish as I had problems with this N router at my house too.

Though my g/f who lives in one of the other rooms couldn't connect to my other roommate's switch, either, so I hard-reset mine, hard-reset my roommate's, left my config alone, turned on AP mode (disable DHCP) on my roommate's, and tried connecting to each. Within 1-2 minutes of a connection, the connection gets dropped (random network error), from his switch or my router - doesn't matter.

I pulled the ethernet on the campus installed wireless AP, and then I was able to get about 3-5 minutes of internet before a network error.

====== lowdown

I've come to the conclusion that the newly installed AP's are broadcasting DeAuth packets (or something of that nature). Is this possible? I mean they have our Mac addresses as they are needed to register a computer to simply access the campus network (internet too), so they can simply traverse a list of MAC's and DeAuth target them.

I would say it's an FCC felony to jam broadcasting of other networks, but since everything connects to the campus network in the end, and the college is private, I feel I would be very wrong by saying so.

It makes perfect sense to me that the campus would want you to use their AP for wireless (so you have to register on their network) opposed to a router where they can't exert as much control/analysis on your direct computer, but 2 of my roommates disagree (I feel ITS would always want more control than less, I mean some say they could have just NAT'd it, but that'd be too tight for a tech school).

Is there A) Any way I can scan for DeAuth packets (I run Linux, Mac, and Windows in some form or another, so platform-dependency isn't really an issue), B) Find out if the signal is indeed being jammed (from the router config end), or C) Any way to find out anything!?

This is really pissing me off, as I'm against full control, I like my internal network, not to mention with their 5 MAC's MAX / UN the cap gets hit really fast .

Any help here? I was thinking backtrack with some of its wireless tools, but I don't know anything about any of them. I know my way around linux in general well - but nothing about specific wireless tools provided (or not provided) in backtrack, nor am I a network specialist.

The access points appear to be Cisco Aironet 1140's with N access, but I could be slightly wrong about the exact model, just using the front, manu name (cisco), shape, and specs to try and get a match.

Any help? Or do I just have to kind of take it up the a$$? I'd like to at least know for sure if I am indeed taking it up the a$$ here, or is it just a massive wireless fu8k up coincidence? Can this AP even do that? (I'm assuming basically any AP can, but I don't know).

Anybody help me here?

EDIT:
PS: As for helping in my quest for the answer, my friend has a friend inside ITS who said something similar to what I thought is what's going on, but 2 points of communication...data gets lost in transit...

Soon I plan to unregister my Mac's MAC from the network and see if it still gets dropped (need a MAC to DeAuth target, right?)

Also, in case you're wondering why I just don't pull the AP's ethernet and leave it, two reasons:
A) According to my friend's friend in ITS, all the AP's are accessible in a nice long list, and can have their signals and the like adjusted on the fly, from one admin web interface, whether this be fact or fiction, I'm sure they can tell if an AP is down and send somebody out to figure out wth is going on.
B) The other appts are just close enough that their signals reach here, even though from what I hear the signal strengths have been dropped - so you still get booted, or jammed, or something .

 

[SJConsultant]

Sounds like they have a managed wireless infrastructure with the capability to "terminate" wireless communications by "rogue" wireless devices not authorized on the network.

In short, changing or deregistering your Mac isn't going to do anything.

 

[Adam12176]

Are you at RIT? I remember working on the planning of the N infrastructure upgrade there. Sounds very familiar.

If you are, let me know. You and your friends are very mistaken on the policy.

Recent alumni if you can't gather that from this post.

EDIT:
Hey hey, you filled in your about me section. You DO go there.

The wireless infrastructure is all lightweight 1142 N pie plates, managed in a central location. And yes, they are running at 60-70% power with appropriate overlap, and will throttle to 100% to try and bridge a downed AP as well.

RIT does not practice any sort of control over wireless airspace, and those AP's do not 'jam'. Quite honestly, the problem is on your end. ITS allows you to register any device on the network, including a router. I can't believe the form has changed much since last spring - you pop in the MAC, and boom, you're registered. End of story. I'm not sure what exactly you are trying to fiddle with on your end, but it really sounds like you're breaking more than you are fixing.

In short, from the wall jack, plug into a router wan port after registering the MAC with start.rit.edu. Plug devices into said router. Done. This works, 100%, as I did this in my dorm. Check your registrations, check to make sure you put the right MAC in. But your finger pointing at the wireless is all for naught.

 

[Electrofreak]

I'm a networking student in Rochester too, (born and raised here,) but I don't attend RIT yet, can't afford it atm tbh.

IMO RIT should have the right to do anything it likes to APs placed on its property, including signal jamming if it so wished. The FCC laws are in place to prevent rogue APs infiltrating private networks and prevent jamming of signals on someone else's property.

 

[Adam12176]

IIRC the AP's can report back to the WISM if it detects a competing wireless signal in the same area. I'd have to look again.

I can get some names from ITS if you want real answers, and not second hand guesses from someone who runs cables all day.

As a stopgap, if you REALLY want to know, quiz Bruce Hartpence. I was part of his network design and performance class that worked with ITS on the planning and features of the N rollout. Ask him to show you where all 1700 access points are too.

 

[Captain Colonoscopy]

1140 series APs are LWAPP only so they're all being controlled by a Wireless LAN Controller somewhere. If your network admin decides he doesn't want rogue or unauthorized wireless access points or routers on his/her network then he/she can have the controller tell the LWAPP APs to "contain" the rogue device.

From Cisco:

Contain rogue access points by sending their clients deauthenticate and disassociate messages from one to four access points. This containment can be done for individual rogue access points by MAC address or can be mandated for all rogue access points connected to the enterprise subnet.

You may also be running into Port-Security settings on the switch ports. Typically the ports are setup to allow only one or two MAC addresses through the port. That would explain why your devices that are plugged into a switch plugged into a wall port stop working after a while.

 

[Adam12176]

If your network admin decides he doesn't want rogue or unauthorized wireless access points or routers on his/her network then he/she can have the controller tell the LWAPP APs to "contain" the rogue device.

Negative. In any other situation this would be completely possible, but my router is still registered from last quarter at the same institution. I spoofed a PfSense VM to the registered MAC even. This is not his problem.

You may also be running into Port-Security settings on the switch ports. Typically the ports are setup to allow only one or two MAC addresses through the port. That would explain why your devices that are plugged into a switch plugged into a wall port stop working after a while.

This is much, much more likely the situation. RIT does employ this, you have to register a device on the network. If you do not register, you are in a captive portal after the system realizes it.

I feel you are making this a lot more difficult than it needs to be. Follow the instructions I posted and let everyone know if it works or not.

If you are going wall port -> switch -> many devices, some registered and some not...well, yeah - that's not going to work hombre.

 

[Syndacate]

Are you at RIT? I remember working on the planning of the N infrastructure upgrade there. Sounds very familiar.

If you are, let me know. You and your friends are very mistaken on the policy.

Recent alumni if you can't gather that from this post.

EDIT:
Hey hey, you filled in your about me section. You DO go there.

The wireless infrastructure is all lightweight 1142 N pie plates, managed in a central location. And yes, they are running at 60-70% power with appropriate overlap, and will throttle to 100% to try and bridge a downed AP as well.

RIT does not practice any sort of control over wireless airspace, and those AP's do not 'jam'. Quite honestly, the problem is on your end. ITS allows you to register any device on the network, including a router. I can't believe the form has changed much since last spring - you pop in the MAC, and boom, you're registered. End of story. I'm not sure what exactly you are trying to fiddle with on your end, but it really sounds like you're breaking more than you are fixing.

In short, from the wall jack, plug into a router wan port after registering the MAC with start.rit.edu. Plug devices into said router. Done. This works, 100%, as I did this in my dorm. Check your registrations, check to make sure you put the right MAC in. But your finger pointing at the wireless is all for naught.

Yeah, it's at RIT. I know how to hook up a wireless router, I've been running one for 4 years, this isn't normal activity, and yes, turning off DHCP and not using the WAN port will make your router act as a switch. Regardless, it's okay, yesterday ITS sent me a cease and desist notice stating that I was [suddenly] in violation of the housing operations terms and agreement.

You were stating "unless a lot has changed since spring" - yeah, a lot has. They did implement their N supernet, but in spring they still were planning and the like, I've been here summer and fall, the AP's just got installed end of summer, and activated over Summer/Fall break.

The cease and desist letter says that the router is registered to my UN (which it is), and that if I don't comply by Nov 4, they're going to ban my UN. Their reasoning is that anything wireless, from AP's to routers to wireless printers could potentially interfere with wireless internet for other students in the area. Whatever, I turned off wireless and contacted them as their e-mail told me to. So it probably was just interference jamming up mine and roommate's router and not anything to do with a direct target.

Though one thing I'm inquisitive about - how would they know if I utilize it as a switch, if it's me? I mean if I disable DHCP, plug it into a LAN port, it's a switch (for those that plan to argue, I've done it before, and it works), it won't have to be registered to my UN anymore, they shouldn't be able to see a switch on the network as all the IP's should be external, although they should be able to see the signal and get pissy about it. I heard they were wifi sniffing the dorms last year so I'm wondering if they'd go that far here in the appts as well. My roommate has his setup as a switch and he hasn't gotten an e-mail, so I'm wondering if that's a better alternative, although at that point it doesn't even matter.

Though it is interference, not just "my problem" - as it's happening to everybody's personal wireless AP's.

So I guess it's just game over for my wifi then.

In accordance with cisco's statement about sending deauth packets and containing rogue networks (which they have full ability to do, so I don't see why it would be so outlandish for them to do so), how could they target it? The WAN MAC would be different from the wireless MAC, right? So the wireless MAC isn't registered with them..unless it's a straight WAN interrupt, but I haven't seen any problems over wired connections...

 

[Adam12176]

Apologies are in order - they did revise the acceptable use policy. You are 100% correct.

That's interesting, considering we covered absolutely nothing about this in the implementation schedule. It's not like we had a huge voice in it, but we were there for the meetings with Cisco reps, and ITS.

Long story short, you're screwed. The fact that they mention that wireless routers are prohibited over and over, they sound fairly serious about this.

As far as using a switch, that's also listed as a fast track to getting the wall port disabled. It's just a guess, but if you see traffic from multiple MACs on the same port, they probably consider it compromised.

The AUP references all that as well: RIT Router Policy

 

[Syndacate]

Hrm.

I wonder what they're going to do about my roommate's wireless, then. It's setup as a switch, but he's the only one that uses it (and that's via wired) (it's WPA2 + MAC filtered & not broadcasting SSID). So since nobody else uses its wireless, they wouldn't see traffic coming from multiple MAC's through his wall port, but they should detect the wireless signal anyway.

I wonder if they'll come in here with a sniffer about it, or if they'll just ignore it.

I still think they're taking this to a bit of an extreme, talking about how the whole floor or possibly building may lose internet because of a mis-configured router. I did a lot of reading up on these cisco 1142 routers, and from the sound of it, they're the be all/end all botnet super N network. Their choice in system makes sense..

I disabled my wireless and contacted them (as instructed). Oh well, they only advocated no wireless since they activated this new massive network (9 weeks ago).

Guess I'm hosed, but whatever, at least it's gotten better (it used to suck really bad), nto to mention I typically use a wired connection. Though the interesting thing would be to see A) What happens to ther 4 other AP's I can pick up without any scan utilities, just in my network list, and B) How actively they go after situations like my roommates...