0

What are some good sources (free) to download attack signatures to develop a intrusion detection system over WLAN?

closed as too broad by Steffen Ullrich, CaffeineAddiction, Anders, Stephane, S.L. Barth Mar 16 '17 at 8:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think you should use snort. github.com/snortadmin/snort3 – M.S.P Mar 16 '17 at 5:52
  • 3
    It is unclear what kind of signatures you expect which are specific to WLAN and therefore I marked this as too broad. As for general signatures for NIDS look at emerging threats. These signatures there are used by several IDS. Also, read what the tags you set actually mean since digital-signature has nothing to do with IDS signatures (tag removed). And just have a look and what other IDS like Snort or Suricata do and you'll find also plenty of information (including signatures) there. In general: learn first what others did before inventing your own. – Steffen Ullrich Mar 16 '17 at 6:02
  • I want rules with which I can match packet data(header, payload) to detect if packet is a potential threat to the network – Shruti Bhatia Mar 16 '17 at 7:25
1

I suspect you may have conflated two things here, as @Steffen Ulrich indicated:

  • on one hand, you are talking about an IDS, which uses signatures, and could detect attacks. But most IDSes (AFAIK) don't treat WLAN distinctly - on the contrary, most IDS signatures (and certainly those from Emerging Threats) focus on IP and application layer - i.e. they look at traffic coming from connected WLAN clients, and indeed, coming from any network connected device. So an IDS will allow you to build what you want, but will do very little to protect your WLAN as such.

  • on the other hand, you are talking about detecting wireless intrusion (I assume), which is a completely different thing. Per https://en.wikipedia.org/wiki/Wireless_intrusion_prevention_system:

In computing, a wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

In other words, you need to choose:

  • if you want to detect network 'attacks', an IDS is the correct solution, but doesn't (fundamentally) care about WLAN vs any other network. It is looking for actual 'attacks' as opposed to looking for signs of wireless intrusion. In other words, this is what will help you detect when something on your network does something.
  • if you want to detect wireless intrusion, you need something that monitor for rogue access points and clients, based not on signatures, but (in essence) on whitelisting. This will help you detect when something is trying to either join your network, or trying to steal clients from your network.

In the long run, both may have their place/use, but you do need to ensure you are picking the right tool for the job you are trying to do.

Not the answer you're looking for? Browse other questions tagged or ask your own question.