## 3 Attacks on HWMP
### Security against Internal Attacks  
The real problem with the WMN is the possibility of an internal attack. Internal attackers can exploit HWMP by using a path diversion attack to create a blackhole or wormhole. An internal attacker may also pretend to be a root mesh STA. When a mesh STA tries to send packets to a target, it will initialize the path discovery process. Before the path is found, it will first use the root mesh STA to forward its packet. This way, it will be possible for the attacker to spy on the first few data packets.  
Table 8 describes the internal attacks, the required security services to protect them, and the relevant HWMP frames and fields involved. By lowering the metric to an extraordinary small value compared to that of the other competing paths, the attacker can divert the route to meet the needs of the attacker. By illegally increasing the sequence number of the routing frame, the attacker can cause the victim nodes to treat this routing message frame as the most recent one. To protect against a path diversion attack, a scheme to detect a fake path metric is required. End-to-end authentication and integrity services are required for the NMF to prevent an intermediate mesh STA from modifying the sequence number. As described in Section 2.2.1, an attacker can set itself up as a root node with RANN and PREQ. To prevent this type of attack, a permission level should be implemented so that only authorized mesh STAs can declare themselves as a root mesh STA. By changing the originator and target address fields, an attacker can impersonate other nodes. End-to-end authentication and integrity services are required for the NMF including the HDR field to prevent an intermediate mesh STA from impersonating another mesh STA.  
\begin{table}
\begin{tabular}{c|c|c|c|c} \hline \hline
**Attacks** & **Descriptions** & **Required Security Services (Point-to-Point)** & **Relevant Frame** & **Involved Field** \\ \hline \multirow{2}{*}{Passive Attack} & Obtaining important information about & \multirow{2}{*}{Encryption} & \multirow{2}{*}{All} & MF \\  & the network & & & NMF \\ \hline \multirow{2}{*}{Flooding Attack} & Continuously broadcasting frames with & Authentication & \multirow{2}{*}{All} & \multirow{2}{*}{All} \\  & false information. & and integrity & & \\ \hline \multirow{2}{*}{Replay attack} & Replay PREQ messages and spoofing & \multirow{2}{*}{Anti-replay scheme} & \multirow{2}{*}{PREO} & \multirow{2}{*}{NMF} \\  & MAC address of victim & & & \\ \hline \multirow{4}{*}{Path Diversion} & Modifying the path metric. & Authentication and integrity & \multirow{2}{*}{
\begin{tabular}{c} PREQ \\ PREP \\ RANN \\ \end{tabular} } & \multirow{2}{*}{MF} \\  & Modifying the sequence number. & Authentication & \multirow{2}{*}{All} & \multirow{2}{*}{NMF} \\  & and integrity & & \\ \hline \multirow{4}{*}{Impersonation Attack} & Impersonating a transmitter by changing & Authentication & \multirow{2}{*}{All} & \multirow{2}{*}{HDR} \\  & the transmitter address field. & and integrity & & \\ \cline{1-1} \cline{3-5}  & \multicolumn{2}{c|}{Impersonating an originator/target by} & Authentication & \multirow{2}{*}{All} & \multirow{2}{*}{NMF} \\ \cline{1-1} \cline{3-5}  & changing the originator/target address field. & and integrity & & \\ \hline \hline \end{tabular}
\end{table}
Table 7: External attacks, the required security services, and the relevant HWMP frames and fields involved.