HP Manager Software manual Other than an associate request flood

422CHAPTER 11: DETECTING AND COMBATTING ROGUE DEVICES

Table 58 SNMP Notifications for RF Detection

Notification Type	Description
RFDetectUnAuthorizedOUI	Indicates that MSS has detected a wireless
	device that is not on the list of permitted
	vendors.
RFDetectUnAuthorizedAP	Indicates that MSS has detected the MAC
	address of an AP that is on the attack list.
IDS/DoS notifications

For more information about IDS/DoS, see the “IDS and DoS Alerts” section in the “Rogue Detection and Countermeasures” chapter of the Wireless LAN Switch and Controller Configuration Guide.

CounterMeasureStart	Indicates that MSS has begun
	countermeasures against a rogue AP.
CounterMeasureStop	Indicates that MSS has stopped
	countermeasures against a rogue access
	point.
RFDetetSpoofedMacAP	Indicates that MSS has detected a wireless
	packet with the source MAC address of a
	3Com MAP, but without the spoofed MAP’s
	signature (fingerprint).
RFDetectSpoofedSSIDAP	Indicates that MSS has detected beacon
	frames for a valid SSID, but sent by a rogue
	AP.
RFDetectDoS	Indicates that MSS has detected a DoS attack
	other than an associate request flood,
	reassociate request flood, or disassociate
	request flood.
RFDetectDoSPort	Indicates that MSS has detected an associate
	request flood, reassociate request flood, or
	disassociate request flood.
RFDetectClientVARogueWiredAP	Indicates that MSS has detected, on the wired
	part of the network, the MAC address of a
	wireless client associated with a third-party
	AP.

To use countermeasures, they must be enabled. You can enable them on an individual radio profile basis. (See “Configuring a Radio Profile” on page 245.)