Licensing

The ability to perform rarescanning is available only with the RFprotect license. However, the AP can scan ‘reg-
domain’ or ‘all-reg-domain’channelswi thout the RFprotect license.
Working with Tarpit Sh ielding
The Tarpit Shieldingfeature is a t ype of wireless containment. Detected devices that are classified as rogues are
contained by forcing client association to a fake channelor BSSID. This method of tarpitting is more efficient than
rogueco ntainmentvi a repeated de-authorization requests.Tarpit Sheilding works by spoofing frames from an AP t o

confuse

a client about its associatio n.The

confused

client assumes it is associated t o the AP on a different (fake)
channelthan the channel that the AP is actually operating on, and will attempt to communicate with the AP in the
fakec hannel.
Tarpit Shieldingwo rksi n conjunction with the

deauth

wireless containment mechanism.The deauth mechanism
triggerst heclient to generate probe requestand subsequent association request frames. TheAP t henresponds with
probe responseand associ ation response frames.Once the monitoring AP sees these frames,i t will spoof the probe-
responseand associ ation response frames,and manipulates the content of the frames to confuse the client.
A station is determined to be i n the Tarpit when we

see

it sending data frames in the fake channel.With some
clients, the station remains in tarpit state until the user manuallydisables and re-enablest hewi relessinterface.
Configuring Tarpit Sh ielding
Tarpit shielding is configuredo n an AP using one of two methods:
Disable all clients—In this method, any client that att empts to associate wit h an AP marked for containment is
sent spoofed frames.
Disable non-valid clients—In this method, only non-authorized clients that attempt to associate with an AP is sent
to the tarpit.
The choices for disabling Tarpit Shielding on an AP are:
lDeauth-wireless-containment
lDeauth-wireless-containmentwit h tarpit-shielding(excluding-valid-clients)
lDeauth-wireless-containmentwit h tarpit-shielding

EnablingTarpit Shielding

Use the ids-general-profile command to configure Tarpit Shielding (fordetai ledi nformation on commands referto
the

Command Line ReferenceGuide

).
ids general-profile default
wireless-containment [deauth-only | none | tarpit-all-sta | tarpit-non-valid-sta]
Use the followingshow commandst o view updated Tarpit Shieldingstatus and the spoofed frames generated for an
AP:
show ap monitor stats …
show ap monitor containment-info

Understand ing Tarpit Shie lding LicensingCLICommands

In the ids general-profile default wireless-containment command,the ‘tarpit-non-valid-sta’ and ‘tarpit-all-sta’
options are available only with a RFprotect license. The ‘deauth-only’ and ‘none’opti ons are availablewi th the Base
OSlicense.
DellPowerConnect W- Series ArubaOS 6.2 | UserGuide WirelessIntrusionPr evention |392