topic WLC Deauthentication flood attack in Wireless

WLC Deauthentication flood attack

Diego Prada — Mon, 05 Jul 2021 07:12:43 GMT

I would like to know what actions can take a Wireless Lan Controller when one of the register Access Points receives an Authentication, Deauthentication or a Disassociation Flood Attack.

Also i would like to know what can be the best practices to mitigate these attacks.

Thanks a lot.

WLC Deauthentication flood attack

Naveen Kumar — Wed, 26 Feb 2014 09:43:39 GMT

Refer you to Rogue Management, Attack Detection and Threat Mitigation document.

https://supportforums.cisco.com/docs/DOC-21899

WLC Deauthentication flood attack

Amjad Abdullah — Sat, 07 Mar 2015 11:47:23 GMT

The most important thing is to locate the attacker and isolate it.

The attack can be intentional (by an attacker) or unintentional (by problematic WLAN driver or by neighbor rogue WLAN system).

By finding the attack source you decide what will you do:

- if problematic driver fix it or otherwise isolate it.

- if neighbor rogue WLANs contact their admin and ask them to add your WLAN as friendly one.

- if an attacker you decide what you will do. You may call 911

To help locating the attack sources, Cisco provides Mobility Service Engine (MSE):

http://www.cisco.com/c/en/us/products/wireless/mobility-services-engine/index.html

Hope this is useful.

Amjad

Rating useful replies is more useful than saying "Thank you"