EP1794934A1

EP1794934A1 - Method, device a program for detecting an unauthorised connection to access points

Info

Publication number: EP1794934A1
Application number: EP05805802A
Authority: EP
Inventors: Laurent Butti; Roland Duffau; Franck Veysset
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2004-09-30
Filing date: 2005-09-21
Publication date: 2007-06-13
Also published as: WO2006035140A1; US20080250498A1

Abstract

The invention relates to a method for detecting the unauthorised connection to a wireless network. A passive radio listening (101) males it possible to retrieve exchanged frames. Specific frames identifying the access points are stored (104). When two frames coming from the same access point are recorded, types of time information are compared (105). When the difference between types of time information does not correspond to a desired value, the unauthorised connection is detected.

Description

METHOD, DEVICE AND PROGRAM PE DETECTION OF ACCESS POINT USURPATION.

The present invention relates to wireless access technologies to telecommunications networks. It applies in particular to IEEE 802.11 type technologies standardized by the Institute of Electrical and Electronics Engineers (IEEE). IEEE 802.11 technologies are widely used in networks _. corporate ,, residentjejs_ainsl. than . in areas of use, intensive. ("hot spots"). More particularly, the invention relates to wireless network hacking by access point address spoofing.

By the term "frame" is meant a set of data forming a block transmitted in a network and containing useful data and service information, generally located in a header area of the block. A frame can be described as a data packet, datagram, data block, or other expression of this type.

With the success and democratization of wireless access technologies, hacking techniques have emerged.

Currently, one of the most important risks for this type of network is the illegitimate access point attack, which consists of creating a false access point by completely usurping the features, including the MAC layer address ("Medium"). Access Control "), from a legitimate access point, controlled by the wireless network administrator. False access points that do not overwrite a MAC address of a legitimate access point are relatively easy to detect by simply checking the MAC address.

The access point is an essential element of communication between a client and a network. Therefore, it is a critical point, and therefore interesting for attackers. Attacks using fake access points appeared in order to:

• retrieve login credentials for users who are authenticated by means of "captive portals" by masquerading as a legitimate access point to intercept identification data such as login credentials;

^• intercept communications by performing a "man in the middle" attack, ie by simulating the behavior of a legitimate access point towards the wireless user and that of a wireless user vis-à-vis the legitimate access point to intercept all communications;

^• a- -d'entreprise open network while ^"leaving ^~~ ^~ uτπ ^spot" directly connected access to the corporate network in open mode, that is to say without any authentication or encryption of the radio channel , this access point accepting any connection request by default.

These attacks are difficult to detect when they implement a MAC address spoofing technique. It is then more difficult to distinguish two different equipments of the same category (access point) emitting from the same MAC address. The arrival of the new and more secure standards (1EEE802.11i) will not prevent the use of illegitimate access points because the interest for the attacker will always be present.

There is therefore a need for an access point MAC address spoofing detection method

A known technique for detecting MAC address spoofing relies on the analysis of the Sequence Number ("Sequence Number") field of frames, or data packets, IEEE802.11 (see J. Wright, "Detecting Wireless LAN"). MAC Address Spoofing ", http://home.jwu.edu/jwright/, January 21, 2003). These sequence numbers, managed at low level in the radio card, are necessarily incremented by one unit for each packet sent. This makes it possible to identify important variations between several successive packets sent by the same MAC address. By comparing these variations with predefined thresholds, it is possible to detect anomalies in the packets appearing coming from a MAC address, and to deduce the probable usurpation of this address by an attacker. This technique requires the management of very precise and delicate thresholds to position. It is difficult to implement on its own and make sure there are no false positives (false alarms) and false negatives (undetected attacks). The main difficulty lies in the management of packet losses, for example during a long-distance transmission. Indeed, some packets are lost, which leads to false positive problems because the sequence numbers vary greatly from one packet to another. It is necessary to manage the detection thresholds very finely. This is why it is interesting to couple this type of technique with another one in order to combine e_r_ (e_s_aiarmes_et.d.a_e_e.confiance-higher-in a set of several techniques rather than one.

The invention proposes a new technique for detection of access point spoofing by using time information contained in frames. A passive radio listening makes it possible to recover exchanged frames. Specific frames identifying access points are stored. When two frames coming from the same access point are stored, time information present in the frames is compared. If the difference between the time information does not correspond to an expected value, then there is detection of an address spoofing and possibly triggering an alarm signaling the access point address spoofing. Frames are data packets whose structure and content are defined in the communication standard used.

According to a first aspect, the invention proposes a method for detecting address spoofing in a wireless network. The method comprises the steps of obtaining frames comprising an address of a device having transmitted the frame and a time tag representative of the instant of transmission of the frame by said device; analyzing the time tags included in the frames having the same transmission device address; and detecting a spoofing of said address based on the analysis of said time tags.

According to a second aspect, the invention proposes a computer program on a data medium and loadable in the internal memory of a computer associated with a wireless interface, the program comprising portions of code for the execution of the steps of the process when the program - AT -

is executed on said computer. The data carrier may be a hardware storage medium, for example a CDROM, a magnetic diskette, a hard disk, a memory circuit, or a transmissible medium such as an electrical, optical or radio signal.

According to another aspect, the invention proposes a device for detecting an address spoof in a wireless network. The detection device comprises means for obtaining frames, said frames comprising an address of an ^A - device ^'that sent the frame ^{^~'} ^~ and a ^"time stamp representative of the time of the frame transmission by the device and time tag analysis means included in the frames having the same transmission device address, said analysis means being able to detect a spoofing of said address as a function of the analysis of said time tags.

According to a more general aspect, the invention proposes a monitoring system for a wireless network, comprising means for capturing a set of frames and a detection device as previously defined.

According to a particular embodiment, the frames further comprise time interval information separating the sending of two successive frames by the transmitting device. The analysis of the time tags of two frames corresponding to the same transmission device address comprises the steps of calculating a difference between the time tags of the two frames, comparing the calculated difference with the time interval, and detecting the spoofing of the sender's address when the calculated difference is not equal to a multiple of the time interval. Preferably, the multiple is less than a predefined integer.

According to another particular embodiment, the frames further comprise a destination address. The analysis of the time tags of two frames corresponding to the same transmission device address and having the same destination address comprises the steps of calculating a difference between the time tags of the two frames, comparing the difference calculated with a threshold, and detection of the usurpation of the address of the transmitter when the calculated difference is greater than or equal to said threshold.

According to a preferred mode, an address spoof is detected if the difference between the time tags of the two frames is zero. .

The invention will be better understood and other features and advantages will appear on reading the description which follows, the description referring to the appended drawings among which; ; _...

FIG. 1 represents an access point theft detection device according to the invention,

FIG. 2 represents an exemplary flow diagram of the operation of the device of FIG. 1,

FIG. 3 represents an exemplary implementation of a detection device within a wireless network.

As a first step in understanding the invention, it is necessary to detail the method of associating a client with an access point according to the IEEE802.11 standard, the association corresponding to the connection of a customer to the network over the air. The association takes place in several phases:

firstly, a client device must identify at least one access point; - A suitable access point to the client device, if multiple access points are available the client chooses the one that seems best suited to him according to various selection criteria, the client requests to authenticate with the access point;

- If the authentication was successful, then the client requests to associate with the access point.

An access point spoofing attack occurs as early as the identification phase of the access point before the authentication request. This identification phase can be done according to two techniques.

A first technique is carried out passively by the client device. The client device listens one or more radio channels, successively or simultaneously, to search for frames having specific beacon frames, the IEEE802.11 standard calls them BEACON Trame. The BEACON frames are sent regularly by an access point and contain various information including: a network identifier (SSID), the MAC address of the access point, and communication parameters usable by the access point. From this information, the customer. has _desjnfQrmatioJis_to initiate communication with the access point and possibly to choose the most appropriate access point to communicate if multiple access points are detected.

A second technique is performed actively by the client device, this is particularly the case when the access points operate in "hidden" mode. The client sends an access point search frame, named PROBE REQUEST frame in the IEEE802.11 standard. The PROBE REQUEST frames contain, among others, the desired network identifier (SSID) and the MAC address of the client device. An access point corresponding to the requested network which receives a PROBE REQUEST frame responds by sending a PROBE RESPONSE frame which includes information among which: a network identifier (SSID), the MAC address of the access point , the MAC address of the client device, and communication parameters that can be used by the access point.

When using an illegitimate access point on the radio path, the attacker usually uses a complete spoofing technique completed by the access point: same network name (SSID), same MAC address. But it does not usually use the same radio channel for radio interference issues.

To detect an attack, the invention is based on a parameter present in the BEACON frames and the PROBE RESPONSE ₁ frames, namely a time tag (called TIMESTAMP in the standard). It is required for these two types of frames, it is coded on 64 bits and is expressed in microseconds, which allows to account for 2 of ⁶⁴ microseconds (approximately 585,000 years). The time tag of a frame includes a temporal information relating to the transmission of this frame, here constituted by the value of a clock of the access point which transmitted the frame at the transmission time of this frame. The clock is usually set to zero when the access point is started. The time tag is generated by the pilot program of the 802.11 radio card at the time of transmission of the frame. It is therefore possible thanks to this label to know how long the access point has been started.

^~~ The invention is based therefore ^"safe detection of a difference between the timestamps generated by two access points: one legitimate and one illegitimate While two access points communicate two labels. different time at the same time when they have the same MAC address, it is then possible to distinguish them, and thus to affirm that an attacker is usurping the MAC address of a legitimate access point This is valid for BEACON frames and PROBE RESPONSE frames.

In a preferred embodiment, both types of attacks are detected simultaneously. But, it is possible to treat separately the detection of these two types of attacks.

For the detection of attacks using BEACON frames, it should be noted that BEACON frames are regularly transmitted by an access point. Each BEACON frame has a time tag that is incremented by the time between sending two frames. Now the time separating two BEACON frames corresponds to a fixed time interval which is indicated by an interval information (called BEACON INTERVAL in the IEEE802.11 standard) which is present in the frame. Thus, when two BEACON frames are received, it should be verified that the time tag is incremented by a duration corresponding to the interval information. In addition, it is possible that some frames are lost for various reasons. To avoid false alarms due to a loss of frame, it is possible to simply check that the time difference between two frames is equal to a non-zero multiple of the interval information. If two frames are received with the same time tag, that is, if the time difference between the two frames is zero, it is clear that the frame has been issued twice by a legitimate access point and an illegitimate access point.

One way to identify this type of attack is:

a) Listen to the radio channel passively. This listening can be done on all channels of the frequency band used according to the IEEE802.11 standard or on one channel at a time by making channel jumps on a regular basis. In the case of channel jumps, it is obvious that many frames will be lost but like the frames _. BEACON. are issued repeatedly, it is clear that we can receive two frames in the case of an attack and that we can compare time labels to verify their compliance.

b) Storing frames corresponding to BEACON frames received in an array of a memory for a given duration. It is not necessary to store the frames indefinitely because several frames from a legitimate access point provide the same information. And if an access point does not send more frame for a certain duration, it is because it is no longer in operation. A slippery study time window should be used which is large enough to allow scanning of all channels if only one channel is being listened to at a time, and large enough to overcome possible frame losses. because of the transmission quality but short enough not to need to use memory space unnecessarily. For example, a given maximum duration of 10 seconds may be suitable.

c) On receipt of a BEACON frame, and after storing the frame in the array, we search in the array for a previous BEACON frame with the same access point MAC address, ie the same address emitter.

d) When a BEACON frame sent by the same access point has been found, the time tag of the frame that has just been received is compared with the time tag of the previous frame, and the difference between the two temporal labels: - If the value of the difference between the time tags is different from a multiple of the interval information, then the current and previous frames were issued by two different devices: detection of the illegitimate access point. Or if the value of the difference between the time labels is equal to zero, then the same frame was emitted twice, which is a sign of an active attack of an illegitimate access point that synchronized its time tag. with that of the access point, legitimate, - but the false access point is still -detected. It is then necessary to emit an alarm and delete the two frames concerned from the table to reset the detection.

- If, on the other hand, the value returned is equal to a non-zero multiple of the interval information, then the frame is valid and sent by a device whose MAC address has not been usurped. We can delete the previous frame of the table and keep only the last frame received.

e) we start again at step a).

The method described above can be improved by considering an additional detection threshold. As we saw earlier, an illegitimate access point can synchronize with the legitimate access point. The detection is then done on the repetition of a time tag. However, it is possible for an illegitimate access point to anticipate this detection by providing a time tag that uses a time tag far removed from the time tag of the legitimate access point while maintaining a label difference that is a multiple of interval information. For this purpose, a comparison is added with a maximum difference threshold which is equal to the sliding time window of study. The threshold is added simply by considering that the multiple of the interval information must be less than a predefined integer corresponding to the sliding study time slot divided by the interval information. In this case, it is necessary to keep all the stored frames that are received for a period corresponding to the sliding time window of study.

For the detection of attacks using PROBE RESPONSE frames, it should be noted that these messages are one-off messages sent in response to a PROBE REQUEST frame issued by a client device. This mechanism is implemented when access points operate in "hidden" mode. Normally, a PROBE REQUEST frame corresponds to a single PROBE RESPONSE frame. However, it is possible that the PROBE RESPONSE frame is not correctly received by the client device and that the latter repeats its request and that the same access point sends a few PROBE RESPONSE frames to the same client device. These messages are few and relatively close in time because they correspond to the repetitions of PROBE REQUEST frames which are for example issued every 100 ms by the client device in the absence of response.

In order to cover the case where several PROBE RESPONSE frames are sent, it is necessary to compare the time tags of two PROBE RESPONSE frames. Two cases can occur in case of an attack. In a first case, the PROBE RESPONSE frame time tag of the illegitimate access point corresponds to the duration since its initialization. The probability that this temporal label is close to that of the legitimate access point is relatively low, so it can be considered that if two time labels are too far apart in time, for example of a duration greater than a few seconds, it can not be the same access point. In a second case, to overcome the time tag, the illegitimate access point could use the same time tag as a PROBE RESPONSE frame. In this second case, the detection of two PROBE RESPONSE frames having the same time tag means that the two frames do not come from a single access point.

A third case could be considered where the illegitimate access point would synchronize with the legitimate access point to provide consistent time messages. However, considering the time required to synchronize the illegitimate access point with the legitimate access point, it is unlikely that such synchronization could be successfully achieved because there are few messages sent on a rather short duration. One way to identify such attacks is:

a) Listen to the radio channel passively. This listening is preferably done on all the channels of the frequency band used according to the standard IEEE802.11 to avoid any loss of frame.

b) Storage of frames corresponding to PROBE frames

RESPONSE in an array of a memory for a given duration. It is not necessary to store frames indefinitely because these frames are of a one-off nature. It is necessary to use a slippery time window of study which is important enough to be sure that no PROBE RESPONSE frame can be taken into account after a first frame but short enough not to need to use memory space unnecessarily. For example, a given maximum duration of 10 seconds may be suitable.

c) On receipt of a PROBE RESPONSE frame, and after having stored its frame in the array, the array is searched for a frame corresponding to a previous PROBE RESPONSE frame having the same access point MAC address, ie ie the same sender address, and the same user device MAC address, i.e. the same destination address.

d) When a PROBE RESPONSE frame sent by the same access point and destined for the same user device has been found, the time tag of the frame just received is compared with the time tag of the previous frame, and the difference between the two time tags is calculated: - If the value of the difference in absolute value between the time tags is greater than a threshold of a few seconds, then the current and previous frames have been sent by two devices different: detection of illegitimate access point. Or if the value of the difference between the time labels is equal to zero, then the same frame was emitted twice, which is a sign of an active attack of an illegitimate access point. It is then necessary to emit an alarm θt delete the two frames concerned table to reset the detection.

- If, on the other hand, the difference value is lower than the threshold and not zero, then the frame is valid and sent by a device whose MAC address has not been usurped. We can delete the previous frame of the table and keep only the last frame received.

e) we start again at step a).

The implementation of the illegitimate access point detection can be done using a computer equipped with a radio interface compliant with one of the physical layers of the IEEE802.11 standard using a radio link. Radio physical layers are defined in particular by the IEEE802.Ha, IEEE802.11b or IEEE802.11g standards. FIG. 1 describes a detection device comprising a computer 1 connected to a plurality of radio interfaces 2.

The computer 1 is for example a standard computer which comprises a central unit 10 connected to a central bus 11. A memory 12 which may comprise several memory circuits is connected to the bus 11 to cooperate with the central unit 10, the memory 12 serving both data memory and program memory. Zones 13 and 14 are provided for storing BEACON frames and PROBE RESPONSE frames. A video interface 15 is connected to the bus 11 in order to be able to display messages for an operator. In our example, the screen is not shown because it is not necessary. However, according to an alternative embodiment, it is possible to use the screen to display alarms to an operator when an illegitimate access point is detected.

A peripheral management circuit 16 is connected to the bus 11 to link with different peripherals according to a known technique. Among the devices that could be connected to the device management circuit, only the main are represented: a network interface 17 which makes it possible to communicate with a not shown wired network, a hard disk 18 serving as the main read-only memory for the programs and data, a floppy diskette reader 19, a CDROM reader 20, a keyboard 21, a mouse 22 and a standard interface port 23. The floppy diskette reader 19, the CDROM reader 20, the keyboard 21 and the mouse 22 are removable. can be deleted after installation of an access point spoof detection software in the hard disk 18. The hard disk 18 can be replaced by another type of equivalent read-only memory, such as for example a Flash memory type . The standard interface port 23 is a port compatible with a standard of communication between the computer and des. external interfaces. In our example, the interface port 23 is for example a PCMCIA standard port or a USB standard port.

In the preferred example, at least one radio interface 2 is connected to the interface port 23, but according to different variants, it is possible to use several radio interfaces 2. Conventionally, the radio interfaces compatible with the IEEE802.11 standard have radio means only allowing to listen simultaneously a reduced number of radio channels.

If it is desired to listen to the entire communication band, it is necessary to have a sufficient number of interfaces to listen to all the channels of the band. When commissioning a radio access point spoofing detection program, the one or more interfaces are configured to listen to all radio traffic on each listened channel.

If one is satisfied with a reduced listening, for example if one limits oneself to the attacks based only on the BEACON frames, a single interface is enough. When activating a detection program, this interface will be configured to listen to all messages exchanged on a channel, and the program will change channels regularly to listen sequentially to all channels.

Figure 2 illustrates an operating flow chart of a program implementing access point spoofing detection. In this preferred example, the two types of frames are detected with global listening of the entire radio communication band.

The program begins with a step 100, during which the Radio interfaces 2 are configured in global listening mode to receive and decode all the frames conveyed by radio on the listened channels. During this step 100, the radio interfaces are positioned on channels to cover all the channels usable by a wireless network in a given space. The detection device is then in a listening stage 101.

The listening step 101 is a waiting step for all the radio interfaces 2. If a message does not contain any frames, it remains in tune. If a radio interface 2 receives a frame, then it decodes it and transmits the frame to the central unit 10. The test 102 illustrates this change of state for a radio interface 2. It should be noted that several interfaces can receive frames at the same time and that frames can be delayed in the processing at the level of the interface manager which serves as a buffer between the radio interfaces 2 and the central unit 10. This type of standby depends on the operating system of the computer and will not be described.

On receiving a frame, the central unit identifies, during the test 103, whether it is a BEACON frame or a PROBE REQUEST frame. If it is not a BEACON or PROBE REQUEST frame, then the operation stops there and the device returns to the listening step 101. If it is a BEACON frame or PROBE REQUEST, the frame is then stored in the memory 12 during a storage step 104.

During the storage step 104, the BEACON frames are stored in a first array corresponding to the memory zone 13, and the PROBE REQUEST frames are stored in a second array corresponding to the memory zone 14. During this storage step, the tables are purified in order to erase the stored frames that are too old to avoid unnecessary storage of data. Frames considered too old are those that have been stored for a period longer than the study window. Then a comparison step 105 is performed.

The comparison step 105 consists in comparing the last stored frame with all the frames present in the table where it has been stored. Thus, for the BEACON frames, all the previous BEACON frames having the same transmitter MAC address are searched in the table, then, for the identified frames, the conformity of the time tags is checked, as indicated above. For the PROBE RESPONSE frames, all the frames corresponding to previous PROBE RESPONSE frames having the same transmitter MAC address and the same destination MAC address are searched in the table, for the identified frames, the conformity of the frames is verified. time labels. as . indicated previously. At the end of the comparison, the test 106 is carried out.

The test 106 closes the processing carried out on the frame, if the time tag is compliant with the time tag of each frame that has been compared, then the central unit returns to the listening step 101. If the difference does not conform to an expected difference as previously defined, then an alarm step 107 is performed.

The alarm step 107 consists of notifying an alarm indicating that an access point is being attacked by address spoofing. The notification of the alarm is preferably done by sending an electronic message, via the network interface 17, to a network server that controls the radio access points. If the detection device is connected to a control screen, it is also possible to display the alarm on the control screen. Then, as indicated previously, the stored frames that are the subject of the alarm are erased from the table where they were stored and we return to the listening step 101.

Figure 3 shows a wireless network disposed in a large room 200. A server 201 supervises a wired network 202. Access points 203 to 208 are connected to the wired network 202 and serve as bridges between the wireless network and the wired network. Access points 203 to 208 are located in room 200 at different locations to obtain good radio coverage.

An access point operating, for example, in the frequency range at 5 GHz can cover a few hundred m ² . Otherwise, 5 GHZ signals pass through obstacles such as partitions and the coverage of an access point can be reduced to a few tens of m ² . To cover an airport correspondence room or an office shelf, several access points are required.

In the example of FIG. 3, it was considered that the transmission conditions were ideal for representing respectively the coverage areas 213 to 218 of the access points 203 to 208.

In order to ensure that no access point address spoofing attack takes place, detection devices 221 and 222 should be placed. Each detection device 221 or 222 corresponds, for example, to the device. represented in FIG. 1 and implements a program corresponding to the flowchart of FIG. 2.

The detection devices 221 and 222 are connected to the network 202 and each have a radio coverage 231 and 232 shown in broken lines. Normally, the detection devices are also placed to provide radio coverage over the entire room 200. However, it is possible that regions of the room 200 are not physically accessible to a device seeking to enter the network. and therefore it is not necessary to cover them. Similarly, an area that is not covered by at least one of the access points may not be controlled because the intruder must necessarily be in an area covered by an access point to receive frames from the point of access. legitimate access.

The placement of the detection devices is subject to the same radio coverage constraints as the access points. However, access points must also provide a certain amount of data that can impose many overlaps of their coverage. The devices are not subject to this problem of minimum flow rate to ensure and may be less numerous than the access points. Detection devices having common coverage areas also provide two alarms instead of one if an intruder is placed in a common area, which makes the detection more reliable.

Claims

A method of detecting address spoofing in a wireless network, comprising the steps of:

- obtaining frames (101) comprising an address of a _.. ι device _{_having.} transmitted the frame and a time tag representative of the instant of emission of the frame by said device;

analyzing (105) the time tags included in the frames having the same transmission device address; and

detecting (106) a spoofing of said address as a function of the analysis of said time tags.

2. The method according to claim 1, wherein the frames further comprise time interval information separating the sending of two successive frames by the transmission device, and in which the analysis of the time tags of two frames corresponding to the same transmission device address comprises the following steps:

calculating a difference between the time tags of the two frames,

comparison of the calculated difference with the time interval,

detection of the spoofing of the address of the transmitter when the calculated difference is not equal to a multiple of the time interval.

The method of claim 2, wherein the multiple is less than a predefined integer.

4. Method according to one of claims 1 or 2, wherein the wireless network is IEEE 802.11 type and wherein the frames are BEACON frames.

The method according to claim 1, wherein the frames further comprise a destination address, and wherein the analysis of the time tags of two frames corresponding to the same transmission device address and having the same destination address comprises the following steps:

calculating a difference between the time tags of the two frames,

- comparison of the calculated difference with a threshold,

- Addressing the issuer's distress when the calculated difference is greater than or equal to the threshold.

6. Method according to one of claims 2 to 5, wherein it detects an address spoofing if the difference between the time tags of the two frames is zero.

The method of claim 5 or claim 6 when dependent on claim 5, wherein the wireless network is of IEEE 802.11 type and wherein the frames are PROBE RESPONSE frames.

A computer program on a data carrier and loadable in the internal memory of a computer associated with a wireless interface, the program comprising portions of code for performing the steps of the method according to any of the claims. when the program is running on that computer.

9. Device for detecting an address spoofing in a wireless network, comprising:

means for obtaining frames (2, 16, 23), said frames comprising an address of a device having transmitted the frame and a temporal tag representative of the instant of transmission of the frame by the device; and

- means of analysis (10, 12-14) of time tags included in the frames having the same transmission device address, said analysis means being able to detect a spoofing of said address as a function of the analysis of said time tags.

The apparatus of claim 9, wherein the frames further include time interval information separating the sending of two successive frames by the transmitting device, and wherein the analyzing means comprises: calculation means capable of calculating a difference between the time tags of two frames having the same transmission device address; comparison means able to compare the calculated difference with the time interval;

detection means able to detect the usurpation of the address of the transmitter when the calculated difference is not equal to a multiple of the time interval.

Apparatus according to claim 9, wherein the frames further comprise a destination address, and wherein the analysis means comprises:

calculation means able to calculate a difference between the time tags of two frames having the same transmission device address and the same destination address,

comparison means able to compare the calculated difference with a threshold,

detection means able to detect the usurpation of the address of the transmitter when the calculated difference is greater than or equal to said threshold.

A monitoring system for a wireless network, comprising means for sensing a set of frames and a device according to any one of claims 9 to 11.