Wireless Network attacks and

Sniffing
CCSIT – King Faisal University
Dr. Ahmed Alyahya
Wireless Network Hacking
• Wardriving.
• Warflying.
• Warwaking.
• Kismet : wireless packet analyzer that can be used for network discovery.
Wireless Network Hacking - Threats
• Access Control Attacks.
• Integrity Attacks.
• Confidentiality Attack.
• Availability Attacks.
• Authentication Attacks.
Wireless Network Hacking
• Rogue Access Point : Rogue Access Point (Rogue AP) What Does Rogue Access Point
(Rogue AP) Mean? A rogue access point (rogue AP) is any wireless access point that has
been installed on a network's wired infrastructure without the consent of the network's
administrator or owner, thereby providing unauthorized wireless access to the network's
wired infrastructure.
• An Evil Twin attack: an evil twin attack takes place when an attacker sets up a fake Wi-Fi
access point hoping that users will connect to it instead of a legitimate one.
• A jamming attack : is an attack in which an attacker transfers interfering signals on a
wireless network intentionally. As a result, it decreases the signal-to-noise ratio at the
receiver side and disrupts existing wireless communication.
Sniffing and Spoofing ?
Sniffing
Sniffing can be Passive and Active :
• Passive : observing network traffic through hub without interaction.
• Active : uses approaches to make a switch send traffic to you.
Sniffing Attack – MAC Flooding
• Switches either “flood” or “forward” data (Switch to Hub)
• If a switch does not know what MAC address is on a port, it will flood the data
until it finds out.

• CAM Table : the table on a switch that stores which MAC address is on which
port.
Sniffing Attack – ARP Poisoning
• Change the cache of machine so that packets are sent to you instead of the
intended target.

Countermeasures:
• XArp
• Default geteway MAC can be added permanently into each machine’s cache.
Sniffing Attack – DHCP Starvation
• Attempt to exhaust all available addresses from the server.
• Attacker sends so many requests that the address space allocated is exhausted.
Questions