Dell 6.2 manual Working with Intrusion Detection, Understanding Infrastructure Intrusion Detection

•When multiple rules match and any one of those matching rules cause the AP to be classified as a Neighbor, then the AP is classified as Neighbor.

•APs classified as either Neighbor or Suspected-Rogue will attempted to match any configured AP rule.

•Once a rule matches an AP, the same rule will not be checked for the AP.

•When the controller reboots, no attempt to match a previously matched AP is made.

•If a rule is disabled or modified, all APs that were previously classified based on that rule will continue to be in the newly classified state.

Working with Intrusion Detection

This section covers Infrastructure and Client Intrusion Detections.

Understanding Infrastructure Intrusion Detection

Detecting attacks against the infrastructure is critical in avoiding attacks that may lead to a large-scale Denial of Service (DOS) attack or a security breach. This group of features detects attacks against the WLAN infrastructure, which consists of authorized APs, the RF medium, and the wired network. An authorized or valid-AP is defined as an AP that belongs to the WLAN infrastructure. The AP is either a Dell AP or a third party AP. ArubaOS automatically learns authorized Dell APs.

Table 105 presents a summary of the Intrusion infrastructure detection features with their related commands, traps, and syslog identification. Feature details follow the table.

Table 105: Infrastructure Detection Summary

Feature	Command	Trap	Syslog ID
"Detecting an 802.11n	ids dos-profile	wlsxHT40MHzIntoleranceAP	126052, 126053,
40MHz Intolerance	detect-ht-40mhz-intolerance	wlsxHT40MHzIntoleranceSta	127052, 127053
Setting" on page 374	client-ht-40mhz-intol-quiet-time
"Detecting Active	ids unauthorized-device-profile	wlsxHtGreenfieldSupported	126054, 127054
802.11n Greenfield	detect-ht-greenfield
Mode" on page 374
"Detecting Ad hoc	ids unauthorized-device-profile	wlsxNAdhocNetwork	126033, 127033
Networks" on page	detect-adhoc-network
374
"Detecting an Ad hoc	ids unauthorized-device-profile	wlsxAdhocUsingValidSSID	126068, 127068
Network Using a Valid	detect-adhoc-using-valid-ssid
SSID" on page 374	adhoc-using-valid-ssid-quiet-time
"Detecting an AP	ids dos-profile	wlsxApFloodAttack	126034, 127034
Flood Attack" on page	detect-ap-flood
374	ap-flood-threshold
	ap-flood-inc-time
	ap-flood-quiet-time
"Detecting AP	ids impersonation-profile	wlsxAPImpersonation	126006, 127006
Impersonation" on	detect-ap-impersonation
page 374	beacon-diff-threshold
	beacon-inc-wait-time

371 Wireless Intrusion Prevention Dell PowerConnect W-Series ArubaOS 6.2 User Guide