What are some good sources (free) to download attack signatures to develop a intrusion detection system over WLAN?
closed as too broad by Steffen Ullrich, CaffeineAddiction, Anders, Stephane, S.L. Barth Mar 16 '17 at 8:06
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I suspect you may have conflated two things here, as @Steffen Ulrich indicated:
on one hand, you are talking about an IDS, which uses signatures, and could detect attacks. But most IDSes (AFAIK) don't treat WLAN distinctly - on the contrary, most IDS signatures (and certainly those from Emerging Threats) focus on IP and application layer - i.e. they look at traffic coming from connected WLAN clients, and indeed, coming from any network connected device. So an IDS will allow you to build what you want, but will do very little to protect your WLAN as such.
on the other hand, you are talking about detecting wireless intrusion (I assume), which is a completely different thing. Per https://en.wikipedia.org/wiki/Wireless_intrusion_prevention_system:
In computing, a wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).
In other words, you need to choose:
- if you want to detect network 'attacks', an IDS is the correct solution, but doesn't (fundamentally) care about WLAN vs any other network. It is looking for actual 'attacks' as opposed to looking for signs of wireless intrusion. In other words, this is what will help you detect when something on your network does something.
- if you want to detect wireless intrusion, you need something that monitor for rogue access points and clients, based not on signatures, but (in essence) on whitelisting. This will help you detect when something is trying to either join your network, or trying to steal clients from your network.
In the long run, both may have their place/use, but you do need to ensure you are picking the right tool for the job you are trying to do.