Detecting Wireless Security Threats Through IEEE 802.11 Frame Field Anomalies

Author

Aria YoungFollow

College

College of Engineering and Polymer Science

Date of Last Revision

2025-08-05 05:42:34

Major

Computer Information Systems

Honors Course

CISS 491-801

Number of Credits

3

Degree Name

Bachelor of Science in Computer Science

Date of Expected Graduation

Fall 2025

Abstract

It is not uncommon for most public spaces to offer Wi-Fi, while it is convenient and affordable, there are significant security risks due to its open nature. Rogue access points pose a security threat to many networks because they have the potential to bypass security measures and intercept traffic containing sensitive information. The attempt to formulate a method that one hundred percent guarantees the detection of a rogue access point has proven to be an intricate and complex problem for many to tackle, as there are numerous ways a rogue access point can be configured. This project aims to demonstrate the harm a simple evil twin RAP can pose to a network even when secured and hardened as well as propose a detection method for a RAP. There will be a network topology that includes a secured and hardened wired network as well as a legitimate access point (AP), the evil twin RAP, and a wireless client among additional traditional wired clients. Two packet captures will be taken, one simply showing the wireless client connecting to the legitimate AP to establish “normal” traffic patterns, and the second capture will showcase the wireless client connecting to the legitimate AP as normal but then being forcibly de authenticated from the legitimate AP and connecting to the RAP instead. This second capture is intended to establish and display “abnormal” traffic. This project establishes that an inconsistent pattern in the sequence number field of the 802.11 frame header and a surge of de-authentication frames are the primary anomalies within the second capture file indicating that a RAP is present in the network. In the future, it may be worthwhile to consider utilizing an intrusion detection system (IDS), such as Snort for detecting a RAP.

Research Sponsor

Nadhem Ebrahim

First Reader

Janet Kropff

Second Reader

Stanley Smith

Honors Faculty Advisor

Janet Kropff

Proprietary and/or Confidential Information

No

Comments

HRP Final Report

Recommended Citation

Young, Aria, "Detecting Wireless Security Threats Through IEEE 802.11 Frame Field Anomalies" (2025). Williams Honors College, Honors Research Projects. 2059.
https://ideaexchange.uakron.edu/honors_research_projects/2059