Wireless Intrusion Prevention

An AC can prevent wireless intrusion from three types of unauthorized devices:

Rogue or interference AP

After an AC identifies a rogue or interference AP, it sends information about the rogue or interference AP to a monitor AP. The monitor AP uses the identity information about the rogue or interference AP to broadcast a Deauthentication frame. After STAs that associate with the rogue or interference AP receive the Deauthentication frame, they disassociate from the rogue or interference AP. This countermeasure prevents STAs from associating with rogue or interference APs.
- Deauthentication frames are used to terminate established wireless links. Either an AP or a STA can send a Deauthentication frame to terminate the current link.
- Currently, an AC supports containment against rogue or interference APs that have the same or similar SSIDs as authorized APs managed by the AC and open-authentication APs.
Unauthorized or interference STA

After an AC identifies an unauthorized or interference STA, it sends information about the unauthorized or interference STA to a monitor AP. The monitor AP uses the identity information about the unauthorized or interference STA to unicast a Deauthentication frame. After the AP with which the unauthorized or interference STA associates receives the Deauthentication frame, the AP disassociates from the unauthorized or interference STA. This countermeasure prevents APs from associating with unauthorized or interference STAs.
Ad-hoc device

After an AC identifies an ad-hoc device, it sends information about the ad-hoc device to a monitor AP. The monitor AP uses the identity information about the ad-hoc device's (BSSID and MAC address of the device) to unicast a Deauthentication frame. After the STAs that associate with the ad-hoc device receive the Deauthentication frame, the STAs disassociate from the ad-hoc device. This countermeasure prevents STAs from associating with ad-hoc devices.