SonicWALL TZ 190 Manuale Utente

To add a station to the watch list:

In the SonicPoint > RF Monitoring page, navigate to the Discovered RF threat stations 
section.

Click the 

 icon that corresponds to the threat station you wish to add to the watch list.

A confirmation screen will appear. Click OK to add the station to the watch list.

If you have accidentally added a station to the watch list, or would otherwise like a station 
removed from the list, click the 

 icon that corresponds to the threat station you wish to 

remove.

Once you have added one or more stations to the watch list, you can filter results to see only 
these stations in the real-time log by choosing “Only Stations in Watch List Group” from the 
View Type drop-down list.

The following is a partial list containing descriptions for the most prominent types of RF 
signatures detected by SonicWALL RF Monitoring:

Long Duration Attacks - Wireless devices share airwaves by dividing the RF spectrum into 
14 staggered channels. Each device reserves a channel for a specified (short) duration and 
during the time that any one device has a channel reserved, other devices know not to 
broadcast on this channel. Long Duration attacks exploit this process by reserving many 
RF channels for very long durations, effectively stopping legitimate wireless traffic from 
finding an open broadcast channel. 

Management Frame Flood - This variation on the DoS attack attempts to flood wireless 
access points with management frames (such as association or authentication requests) 
filling the management table with bogus requests.

Null Probe Response - When a wireless client sends out a probe request, the attacker 
sends back a response with a Null SSID. This response causes many popular wireless 
cards and devices to stop responding.

Broadcasting De-Authentication - This DoS variation sends a flood of spoofed de-
authentication frames to wireless clients, forcing them to constantly de-authenticate and 
subsequently re-authenticate with an access point.

Valid Station with Invalid (B)SSID - In this attack, a rouge access point attempts to 
broadcast a trusted station ID (ESSID). Although the BSSID is often invalid, the station can 
still appear to clients as though it is a trusted access point. The goal of this attack is often 
to gain authentication information from a trusted client. 

Wellenreiter/NetStumbler Detection - Wellenreiter and NetStumbler are two popular 
software applications used by attackers to retrieve information from surrounding wireless 
networks.