Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean:

it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. when you've authenticated, the router knows that your personal encryption credentials are associated to the IP it grants you, say 1.2.3.4. thus if a packet not encrypted with your credentials comes in with source 1.2.3.4, it's not from you but from a spoofer; if a packet encrypted with your credentials comes in with source other than 1.2.3.4, you're a spoofer; and last but not least, no one can send a packet encrypted with someone else's credentials.

given the above, i'd like to know

  1. is my understanding correct (i.e., can one easily identify IP spoofers and IP spoofed packets under WPA-Enterprise)?
  2. is it standard/common or unheard of/uncommon for routers to drop/reject spoofed packets under WPA-Enterprise?
  3. in the latter case, does anyone know of any (ideally OpenWRT-compatible) packages that do this or alternatively have any pointers about where to start to implement one?

thanks!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I don't think there is any inherit protection against IP address spoofing in a WPA-Enterprise environment and from a security preservative, this doesn't really matter because there are other implicit mitigations against ip address spoofing. Snort and other NDIS solutions have rule-sets to detect IP spoofing, and ARP table poisoning. These technologies are usually deployed in an enterprise environment.

Being able to spoof the ip address of another member on the network isn't very helpful if you can't see the response. WPA-Enterprise uses a unique key for each member on the network so you cannot see the response (and you could see this repose if the wifi was unencrypted).

MAC address spoofing and ARP table poising are much MUCH bigger threat than ip address spoofing. You can always forge a packet with an arbitrary source address, if you are unable to receive traffic on this IP address then you cannot complete the TCP three way handshake, and thus unable to establish a TCP connection. UDP and ICMP are fair game, but even then there is a very limited impact.

share|improve this answer
    
thanks! the project i'm working on requires that i track each user's exact data usage. that's why i'm worried about A generating traffic as B: even if A can't read the response, he can mess up my usage counts out of mischief. is there anything more lightweight than snort to prevent this? as for ARP table poisoning, i haven't been able to find a clear answer on whether or not it's possible under WPA-Enterprise. if i understand correctly, even if A did mess up the ARP table and took B's "place", he'd still be unable to decrypt B's traffic, right? so the incentive is still just mischief? –  rmanna Mar 7 '13 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.