Passive Online Detection of 802.11 Traffic Using Sequential Hypothesis Testing With TCP ACK-Pairs

This paper proposes two online algorithms to detect 802.11 traffic from packet-header data collected passively at a monitoring point. These algorithms have a number of applications in real-time wireless LAN management, for instance, in detecting unauthorized access points and detecting/predicting performance degradations. Both algorithms use sequential hypothesis tests and exploit fundamental properties of the 802.11 CSMA/CA MAC protocol and the half-duplex nature of wireless channels. They differ in that one requires training sets, while the other does not. The authors have built a system for online wireless traffic detection using these algorithms and deployed it at a university gateway router.