Dell 6.2 Understand ing Client Intrusion Dete ction

377| Wireless Intrusion Prevention DellPowerConnect W- Series ArubaOS 6.2 | User Guide
Detecting Wellenreit er
Wellenreiteris a passive wireless network discovery tool that is used to compile a list of A Ps alongwi th theirMA C
address,SSID, channel, security setting in the vic inity. It passively sniffs wireless traffic and with certain version
(versions 1.4, 1.5, and 1.6) sends active probes that target known default SSIDs.
Understand ing Client Intrusion Dete ction
Generally,clients are more vulnerableto attacks than APs. Clients are more apt to associate with a malignant AP
duet o theclient’s driver behavior or to a misconfiguredclient. It is i mportantto monit orauthorized clients to track
their associations and to track any at tacks raised against the client.Client attack detection is categorized as:
lDetecting attacks against Dell APs c lients—Anat tacker can performan active D OS attack against an associated
client, orperform a replay attack to obtain the keys oft ransmissionw hichcould lead to more serious attacks.
lMonitoring Authorized clients—Since clients are easily tricked into associating wit h unauthorizedAPs , tracking
allmisass ociations of authorized clients is very important.
An authorized client is a client authorized to use the WLAN network. In ArubaOS,an authorized client is called a
valid-client . ArubaOSautomatically learns a valid client. A client is determined to be valid if it i s associated to an
authorized or valid AP using encryption; either Layer 2 or IPSE C.
NOTE:Detection of attacks is limited to valid clients and clients associated to valid APs. Clients that are associatedas guests using
unencryptedassociation are included in the attack detection. However, clients on neighboring (interfering) APs are not tracked for
attackdetection unless they are specified as valid.
Table1 06 presents a summary of the client intrusion detection features with their related commands, traps, and
syslog identification. Details of each feature follow the table.
Feature Command Trap Syslog ID
"Detectinga Block
ACK DoS"on page
379
ids-dos-profile
detect-block-ack-attack
block-ack-quiet-time
wlsxBlockAckAttackDetected 126087,127087
"Detectinga
ChopChopAttack" on
page379
ids-dos-profile
detect-chopchop-attack
chopchop-quiet-time
wlsxChopChopAttackDetected 126078,127078
"Detectinga
DisconnectStation
Attack" on page 379
idsdos-profile <name>
detect-disconnect-sta
disconnect-sta-quiet-time
disconnect-sta-assoc-resp-threshold
disconnect-deauth-disassoc-threshold
wlsxNDisconnectStationAttack 126035,127035
"Detectingan EA P
RateAn omaly"on
page379
ids-dos-profile
detect-eap-rate-anomaly
eap-rate-threshold
eap-rate-time-interval
eap-rate-quiet-time
wlsxEAPRateAnomaly 126032,127032
"Detectinga FATA -
JackAttack Structure"
onpage 379
idsdos-profile
detect-fatajack-attack
fatajack-attack-quiet-time
wlsxFataJackAttackDetected 126072, 127072
Table10 6: ClientDetect ionSummary