What is a WIPS?
A wireless intrusion prevention system (WIPS) listens to the radio spectrum around an organization's sites and compares what it hears with what should be there: the authorized access points, the corporate SSIDs and the clients allowed to join them. Firewalls and wired sensors never see a laptop associating with a fake access point in the parking lot, so wireless threats need sensors that listen to the air. A system that only alerts is sometimes called a wireless IDS (WIDS); the prevention part is a WIPS's ability to contain what it finds.
How a WIPS listens
Sensors are either dedicated radios mounted around the building or ordinary access points that spend part of their time scanning other channels between serving clients. Dedicated sensors scan continuously and catch more. Time-sliced scanning costs nothing extra but can miss short bursts of activity on channels it is not watching at that moment. Sensors report to the wireless controller or a cloud console, which keeps the inventory of known devices and classifies everything else it hears.
What a WIPS detects
- Rogue access points: unauthorized APs connected to the corporate wired network, often a consumer router plugged into a desk jack. The WIPS confirms the wired connection by matching the AP's MAC addresses or traffic with what the switches see, which separates a rogue from a harmless neighbor.
- Evil twins: APs broadcasting the company's SSID, or a close copy of it, that are not in the inventory.
- Deauthentication and disassociation floods: bursts of forged management frames that knock clients offline, often to push them toward an evil twin or to capture a handshake for offline cracking.
- Risky client behavior: corporate laptops joining unknown networks, ad hoc networks, or devices spoofing an authorized AP's MAC address.
- Policy violations: an authorized AP broadcasting an open or WPA2-Personal network where policy requires enterprise authentication.
Example: handling a rogue alert
A WIPS console raises a critical alert: an unknown AP named HP-Print-4F2 on channel 11 whose wired-side MAC address shows up on a switch port in the warehouse office. That match makes it a rogue, not a neighbor. The fastest containment happens on the wire: shut down the switch port, which closes the back door into the network at once, then send someone with a handheld locator to find the device, remove it and learn who installed it. Many WIPS products can also contain a rogue over the air by sending deauthentication frames to its clients. Keep that for rogues proven to be on your own network; jamming or deauthenticating other people's Wi-Fi can be illegal, and in the United States the FCC has fined operators for blocking guests' personal hotspots.
WIPS vs. NIPS, 802.1X and Protected Management Frames
- NIPS: inspects packets on a wired segment and cannot hear the radio traffic between a laptop and a fake AP.
- 802.1X: on the wireless network it keeps unauthorized users off the corporate SSID, but it does nothing about a rogue AP plugged into a wired jack. 802.1X on wired ports blocks that, and a WIPS finds the ones that slip through.
- Protected Management Frames (802.11w): let clients reject forged deauthentication frames, and WPA3 requires them. PMF prevents the attack; a WIPS detects the attempts and the devices behind them.
WIPS on the CompTIA Security+ exam
Wireless intrusion prevention is taught with network intrusion detection and prevention among the mitigating controls in SY0-801 objective 4.1, and WIPS is on the exam's acronym list. Wording such as an unauthorized access point plugged into an office jack, wireless users keep getting disconnected or detect access points imitating the corporate SSID points to a WIPS. Distractors include a NIDS or NIPS on the wired network, which cannot hear the radio side; 802.1X on its own, which controls who joins the authorized network but does not find unauthorized hardware; and MAC filtering, which an attacker defeats by copying an allowed address.