---
title: Deactivate Wireless Network Interfaces
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Deactivate Wireless Network Interfaces
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Deactivate Wireless Network Interfaces
 
## Description{% #description %}

Deactivating wireless network interfaces should prevent normal usage of the wireless capability.

Verify that there are no wireless interfaces configured on the system with the following command:

```
$ ls -L -d /sys/class/net/*/wireless | xargs dirname | xargs basename -a
```

## Rationale{% #rationale %}

The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if ( ( ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) ); then

if [ -n "$(find /sys/class/net/*/ -type d -name wireless)" ]; then
    interfaces=$(find /sys/class/net/*/wireless -type d -name wireless -print0 | xargs -0 -n1 dirname | xargs -n1 basename)

    for i in $interfaces; do
        ip link set dev "$i" down
        drivers=$(basename "$(readlink -f /sys/class/net/"$i"/device/driver)")
        echo "install $drivers /bin/false" >> /etc/modprobe.d/disable_wireless.conf
        modprobe -r "$drivers"
     done
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```gdscript3
- name: Deactivate Wireless Network Interfaces - Find wireless marker directories
  ansible.builtin.find:
    paths: /sys/class/net
    file_type: directory
    patterns: wireless
    recurse: true
    follow: true
    depth: 2
  register: wireless_paths
  when: ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Deactivate Wireless Network Interfaces - Extract interface names from directory
    paths
  ansible.builtin.set_fact:
    wireless_interfaces: '{{ wireless_paths.files | map(''dirname'') | map(''basename'')
      | list }}'
  when: ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman",
    "container"] ) )
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Deactivate Wireless Network Interfaces - Bring wireless interfaces down
  ansible.builtin.command:
    cmd: ip link set dev {{ item }} down
  with_items: '{{ wireless_interfaces }}'
  when:
  - ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    ) )
  - wireless_interfaces | length > 0
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Deactivate Wireless Network Interfaces - Get driver path for each interface
  ansible.builtin.command:
    cmd: readlink -f /sys/class/net/{{ item }}/device/driver
  register: wireless_drivers
  with_items: '{{ wireless_interfaces }}'
  changed_when: false
  check_mode: false
  when:
  - ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    ) )
  - wireless_interfaces | length > 0
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Deactivate Wireless Network Interfaces - Create disable wireless driver modprobe
    config
  ansible.builtin.blockinfile:
    path: /etc/modprobe.d/disable_wireless.conf
    create: true
    mode: 420
    block: |
      {% for r in wireless_drivers.results %}
      install {{ r.stdout | basename }} /bin/false
      {% endfor %}
  when:
  - ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    ) )
  - wireless_interfaces | length > 0
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces

- name: Deactivate Wireless Network Interfaces - Unload wireless kernel modules
  ansible.builtin.command:
    cmd: modprobe -r {{ item.stdout | basename }}
  with_items: '{{ wireless_drivers.results }}'
  when:
  - ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    ) )
  - wireless_interfaces | length > 0
  tags:
  - DISA-STIG-UBTU-22-291015
  - NIST-800-53-AC-18(3)
  - NIST-800-53-AC-18(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSS-Req-1.3.3
  - PCI-DSSv4-1.3
  - PCI-DSSv4-1.3.3
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
  - wireless_disable_interfaces
```