Patent Description:
As WLAN radio channels are unlicensed, the same radio channel may be in use by any number of neighbouring WLANs. In operation, a Sniffer will capture all wireless packets on the radio channels to which it is tuned, which may include packets carried on wireless networks other than that in which it is operating. When using a Wireless Sniffer in such an environment it is desirable that only the packets of a particular WLAN are captured, rather than capturing all the packets from all the visible WLANs.

In another situation capturing the wireless packets has privacy implications concerning how the captured data is stored and used. In such cases it would be necessary to anonymise wireless packets (before storage) for any packets that are captured from neighbouring WLANs.

It is therefore desirable to have the ability to identify wireless packets that belong to a particular WLAN, with little or no prior manual configuration.

It is known, for example from <CIT>, to connect a wireless sniffer to a WLAN base station both wirelessly and using a wired connection, in order to detect unauthorised network access. <CIT> describes a sniffer apparatus and method for providing intrusion detection for local area wireless networks. <CIT> describes methods implemented with a modem processor of a mobile communication device to detect rogue access points and take corrective actions. <CIT> describes a client device and method for analysis of a predetermined set of parameters associated with a radio coupling to a WLAN. <CIT> describes a method and apparatus for monitoring multiple network segments in local area networks for compliance with wireless security policy.

In the following, examples and references to "embodiments" outside the scope of the claims are to be considered comparative examples.

A similarity metric may be used to compare base station identities (BSSIDs) detected by the wireless receiver with MAC addresses reported on the dedicated link. A similarity metric may also be used to compare a plurality of Service Set Identities (SSIDs) detected by the wireless receiver with each other in order to classify closely matching SSIDs as belonging to a particular WLAN.

A static list may be used to exclude of known Public SSIDs from consideration
The method may be used to identify transmissions received by the receiver not having signature data associated with the first network, allowing such transmissions to have the data contained therein to be anonymised before analysis.

The dedicated link may be a fixed Ethernet or Powerline connection, or a wireless connection operating in a frequency band separate from that of the first wireless network. Alternatively, the network management system may be incorporated in a wireless communications server also incorporating a sniffer element for receiving the wireless transmissions.

Examples use similarity metrics between the wireless and wired networks so that wireless packets can be classified as either belonging to the connected WLAN or to a neighbouring WLAN. This mechanism can be used by a wireless sniffer to automatically distinguish between the wireless traffic on a targeted network and the wireless traffic on a neighbouring network.

A wireless Sniffer is a device that listens on one or more radio channels (e.g. for a dual band Sniffer, a <NUM> channel and a <NUM> channel) for wireless packets and captures them on a storage device. The wireless packets captured can then be viewed or processed using standard tools (e.g. Wireshark) to analyse the behaviour of the wireless network. As WLAN radio channels are unlicensed, the same radio channel can be used by any number of neighbouring networks. When operating, a Sniffer will capture all wireless packets on the radio channels to which it is tuned, which may include packets on multiple wireless networks.

The present disclosure provides a mechanism that can be used by a wireless sniffer to automatically distinguish between the wireless traffic on a targeted network and the wireless traffic on a neighbouring network. The differentiation between the targeted and the neighbouring network is important as the Sniffer can then treat packets differently e.g. by anonymising neighbouring packets (to adhere to privacy regulations) or by dropping neighbouring wireless packets and only capturing targeted wireless network packets etc..

By way of example, an embodiment of the disclosure will be described with reference to the drawings, in which:.

In this embodiment a wireless network can be targeted by physically connecting the sniffer to the network's logical network segment with a fixed layer-<NUM> connection (e.g. Ethernet, Powerline etc.). As shown in <FIG>, three wireless network routers <NUM>, <NUM>, <NUM> serve respective groups of access points <NUM>, <NUM>, <NUM>; <NUM>, <NUM>, <NUM>; <NUM>. A sniffer <NUM> is arranged to detect transmissions <NUM>, <NUM>, <NUM>, <NUM> associated with the WLAN operated by the router <NUM> but, for the purposes of illustration, it is assumed that transmissions <NUM> from one of the access points <NUM> are failing to be detected. However, the sniffer can also detect transmissions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> from the other networks and needs to distinguish these from those associated with the network it is concerned with.

The sniffer <NUM> may be embodied as a component of the router <NUM> of its own network, but for clarity it is depicted here as a separate element, with a connection <NUM> to the router <NUM>, this connection being independent of the wireless LAN. The connection may be a fixed line such as ethernet or powerline system, or it may be a wireless connection operating in a frequency band separate from that in which the "sniffing" is taking place, or otherwise distinguishable from such transmissions. This link <NUM> allows communication between the sniffer <NUM> and router <NUM>.

The functional elements of the sniffer <NUM> are depicted in <FIG>. These may be embodied in software. The sniffer has an RF interface <NUM> capable of receiving radio beacons in the frequency band or bands of relevance to the WLAN it is serving. It also has an interface such as an Ethernet connection <NUM> through which it can communicate with the router <NUM> independently of the radio interface <NUM>. It will be understood that the fixed connection <NUM> can communicate only with the associated router <NUM>, whilst the RF interface is able to detect radio beacons from any RF sources <NUM>-<NUM>, <NUM>-<NUM>, <NUM>, <NUM> within range, regardless of which WLAN they are part of. It is also possible that an RF source <NUM> operating on the associated WLAN fails to be detected by the sniffer, if for example the source is in a location at which the signal is suffering severe attenuation, or there is a fault with its RF transmitter.

The sniffer <NUM> has a data interface <NUM> which communicates with the router <NUM> over the connection <NUM> to probe the access points <NUM>, <NUM><NUM>, <NUM> on the associated WLAN to retrieve their network identities (BSSIDs) and store them in a data store <NUM>.

A selection processor <NUM> has provision for comparing network identities of signals received by the RF interface <NUM> with network identities of signals detected by the dedicated interface. Signals which match the stored data are forwarded to a quality measurement function <NUM> which analyses the signals for properties such as Bit/error rate, signal to noise ratio etc, and forwards the results to an output <NUM>. The output <NUM> may be a human interface such as a screen, a data store such as flash drive, or an interface with a communications medium to transmit the measurements to a remote location.

Connecting the Sniffer to the subnet <NUM> with a fixed or other duplicate connection <NUM> gives the Sniffer two views onto the network. By correlating information from these two views it is possible for the Sniffer to determine which of the wireless BSSIDs <NUM>, <NUM>, <NUM> (i.e. Wireless Access Points) it can detect are on the targeted wireless network, and which BSSIDs <NUM>, <NUM>,<NUM>,<NUM>; <NUM>, <NUM> it can detect are on neighbouring networks. Once the sniffer has determined this it can differentiate the captured wireless packets as either targeted or neighbouring packets appropriately. The sniffer may also report if any BSSID's that should be detected are in fact absent.

In this specification, the following terms are used with the following definitions:.

The Sniffer gathers information from both the fixed and wireless views. In the wireless view scans are carried out on the <NUM> and <NUM> bands and for each BSSID detected the following information is gathered.

In the fixed view, using the command: "ip ro" the following information can be extracted.

An "arping" is carried out on each host IP address in the subnet in order to discover all active MAC addresses on the subnet. The "arping" operation is a computer software tool for discovering and probing hosts on a computer network. Arping probes hosts on the attached network link by sending Link Layer frames using the Address Resolution Protocol (ARP) request method addressed to a host identified by its MAC address of the network interface.

This embodiment determines which of the BSSIDs seen on the wireless channels are on the targeted network and which on a neighbouring network. Once it has determined the set of BSSIDs that form the targeted network it can then identify which channels to listen to in order to capture the wireless traffic on the targeted network, and can also identify which BSSIDs are to be anonymised.

The operation of the sniffer is depicted in the flow chart in <FIG>.

At step <NUM> the subnet address/class and Gateway MAC address are obtained from the fixed network connection <NUM> using the command "ip ro". The Gateway MAC, IP, and Subnet mask data are stored (in a store <NUM>) by the sniffer for use in later stages.

At step <NUM>, a Wi-Fi scan is carried out using the RF interface <NUM> on both the <NUM> and <NUM> bands to create a list of scanned BSSIDs. Each BSSID in the list is then classified as Public or Private (step <NUM>) based on a Public SSID list <NUM> obtained over the fixed link <NUM> or previously stored. The data SSID, RSSI, Band, Channel/BW, BSSID and Type are stored in a list <NUM> of scanned BSSIDs.

At step <NUM> the Gateway MAC is compared with each Private BSSID in the Scanned BSSIDs list <NUM>. If a close match is found, the Band, Channel & Bandwidth of the matching BSSID are retrieved from the store <NUM> and the result stored in a list of channels to be monitored <NUM>. This operation allows the Sniffer to determine the Channel & BW of the wireless AP that it is connected to.

At step <NUM>, an arping operation is carried out (over the fixed network connection <NUM>) on all hosts in the subnet, whose Gateway MAC, IP, Subnet mask are again retrieved from the store <NUM> and the response IP and MAC of all replying hosts is recorded in order to obtain a list of all active MAC addresses on the fixed subnet, which is sent to a store <NUM>.

At step <NUM>, for each Active MAC address on the fixed subnet (retrieved from store <NUM>), a close BSSID match is sought to a Private BSSID in the Scanned BSSIDs list <NUM>. If a close match is found the SSID of the matching BSSID is added to a list <NUM> of Correlated SSIDs
At Step <NUM>, the BSSIDs in the Capture Channels <NUM>, are appended to a Distribution System BSSIDs list <NUM>.

At step <NUM>, the Scanned BSSIDs list <NUM> is scanned for any SSID that is also in the list <NUM> of Correlated SSIDs. For any matching SSID, the Band and BSSID are added to the Distribution System BSSIDs list <NUM> if they are not already present.

At step <NUM>, for each BSSID already in the Distribution System BSSIDs list <NUM>, a close BSSID match is sought for each Scanned Private BSSID <NUM>. If a close match is found, then the BSSID in the Scanned BSSIDs list is added to the Distribution System BSSIDs list <NUM>, if it is not already there.

At step <NUM> a (temporary) list is constructed of SSIDs that correspond to the BSSIDs held in the Distribution BSSID list <NUM>. Each SSID in this list is compared with the SSIDs in the WiFi Scanned BSSID List <NUM> to identify any that are a close SSID match. The BSSIDs that correspond to the closely matching SSIDs are added to the Distribution list <NUM>.

Claim 1:
A method of identifying wireless transmissions carried on a wireless local area network, 'WLAN' for analysis, the method comprising a wireless network sniffer device (<NUM>):
receiving, at an interface unit (<NUM>) of the wireless network sniffer device (<NUM>), over a dedicated link from a network management system controlling the WLAN, network identity signature data associated with the WLAN;
detecting, at a wireless receiver (<NUM>) of the wireless network sniffer device (<NUM>), wireless transmissions;
identifying network identity signature data from each wireless transmission;
comparing the network identity signature data received at the interface unit (<NUM>) with the network identity signature data identified from the wireless transmissions to identify which of the wireless transmissions were carried on the WLAN;
dropping any of the wireless transmissions not identified as having been carried on the WLAN; and
capturing any of the wireless transmissions identified as having been carried on the WLAN for analysis;
the method being characterised in that comparing the network identity signature data received at the interface unit (<NUM>) with the network identity signature data identified from the wireless transmissions to identify which of the wireless transmissions were carried on the WLAN comprises:
classifying a Basic Service Set Identity, 'BSSID', in the network identity signature data identified from the wireless transmissions as belonging to the WLAN by determining that it closely matches a MAC address in the network identity signature data received at the interface unit (<NUM>); and
classifying a Service Set Identity, 'SSID', in the network identity signature data identified from the wireless transmissions as belonging to the WLAN by determining that it closely matches an SSID in the network identity signature data received at the interface unit (<NUM>), where close matching is determined when octets are compared and found to differ by less than a defined number of bits.