Wireless Network Monitoring via Client-Side Channel Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 802.11k standard is inadequate for identifying and locating rogue devices, as it does not allow querying all trusted stations to find a specific rogue device, and it is inefficient in handling large reports, disassociation storms, and CTS storm detection.
Innovation Solution
Implementing a technique where clients, instead of access points, scan channels, allowing for the use of multiple scanning clients or proxy clients to gather and report RF data, enabling continuous or nearly continuous channel scanning and reducing the need for access points to scan channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If access points scan channels to monitor wireless networks, then channel monitoring capability is provided, but service disruptions occur and scanning efficiency is reduced
Solution Approach 1:
The patent segments the channel scanning function from access points and assigns it to dedicated client devices. Multiple clients perform scanning concurrently, dividing the monitoring task across multiple independent units. This allows scanning operations to occur without disrupting access point services, as clients handle the scanning burden while access points maintain normal client connections.
Solution Approach 2:
The patent introduces client devices as intermediary elements between access points and the monitoring system. These clients act as mediators that perform channel scanning and report findings to access points or central controllers, eliminating the need for access points to directly perform scanning operations. This intermediary role allows monitoring functionality to be added without compromising access point service delivery.
2Difficulty of detecting and measuring
If the 802.11k standard queries trusted stations to identify rogue devices, then rogue device detection is attempted, but the ability to locate specific rogue devices is insufficient
Solution Approach 1:
The patent replaces the mechanical querying approach of 802.11k with a signal-based detection system. Clients continuously scan channels and capture RF signals, using signal characteristics (strength, timing, content) to identify and locate rogue devices. This substitution of passive querying with active signal analysis enables both detection and precise location determination through triangulation and signal strength measurement.
Solution Approach 2:
The patent uses multiple client devices to create redundant copies of the scanning and detection function. Each client independently scans and reports, providing multiple perspectives on the wireless environment. This copying approach enhances detection reliability and enables location determination through comparison of observations from multiple positions, improving both detection capability and location precision.
3Reliability
If access points perform channel scanning, then monitoring coverage is achieved, but service disruptions and channel switching overhead increase
Solution Approach 1:
The patent inverts the traditional scanning architecture by having clients scan channels instead of access points. Clients, which are already mobile and capable of channel switching, perform the scanning function. This inversion eliminates the need for access points to switch channels, as clients handle channel transitions while maintaining their connection to the access point. Monitoring coverage is achieved through client reports without access point channel switching overhead.
4Loss of information
If large frame reports are generated to capture all RF activity, then comprehensive monitoring data is collected, but processing overhead and report size become excessive
Solution Approach 1:
The patent extracts and filters only the most relevant information from RF captures before generating reports. Instead of transmitting complete frame dumps, clients analyze captured signals and extract key parameters such as MAC addresses, signal strength, frame types, and timing information. This extraction process maintains data completeness for security analysis while dramatically reducing report size and processing complexity through selective information transmission.
Data Source
AI summary
A technique for wireless network monitoring involves scanning channels using clients instead of access points. An example of a method according to the technique may include, for example, receiving from a wireless access point a command to perform a channel scanning function, listening on a channel associated with the channel scanning function, and sending RF data found on the channel to the wireless access point. Another example of a method according to the technique may include, for example, scanning a first channel, switching from the first channel to a second channel, sending data on the second channel to an access point, switching from the second channel to the first channel, and resuming scanning on the first channel. A system according to the technique may include one or more scanning clients, proxy clients, multi-channel clients, or other clients that are capable of scanning channels in lieu of an access point.