Dell PowerConnect W-Airwave W-Airwave 7.2 Configuration Guide - Page 86

Profiles > IDS > Unauthorized Device, Impersonation, Profiles > IDS &gt

Get Dell PowerConnect W-Airwave PDF manuals and user guides View all Dell PowerConnect W-Airwave manuals
Add to My Manuals
Save this manual to your list of manuals

Page 86 highlights

Table 33 Profiles > IDS > Impersonation Settings (Continued) Field Default Description Protect from AP No Impersonation Beacon Diff Threshold 50 (0-100%) When AP impersonation is detected, use this control to set both the legitimate and impersonating AP to be disabled using a denial of service attack. Set the percentage increase in beacon rate that triggers an AP impersonation alert. Beacon Increase Wait 3 Time (0-360000 sec) Detect Sequence No Anomaly Set the time, in seconds, after the Beacon Diff Threshold is crossed before an AP impersonation event is generated. Enable or disable detection of anomalies between sequence numbers seen in 802.11 frames. During an impersonation attack, the attacker may spoof the MAC address of a client or AP - if two devices are active on the network with the same MAC address, the sequence numbers in the frames will not match since the sequence number is generated by NIC firmware. Sequence Number of 300 Difference (0-100000) Set the maximum allowable tolerance between sequence numbers within the Sequence Number Time Tolerance period. Sequence Number Time 300 Tolerance (0-360000 sec) Time, in seconds, during which sequence numbers must exceed the Sequence Number Difference value for an alarm to be triggered. Sequence Number Quiet Time (60-360000 sec) 900 After an alarm has been triggered, the time (in seconds) that must elapse before another identical alarm may be triggered. Detect AP Spoofing Yes Whether to detect AP Spoofing. NOTE: Requires a WIDS license. AP Spoofing Quiet Time 900 Time to wait, in seconds, after a spoofing attempt to resume the check. Detect Beacon Wrong No Channel Beacon Wrong Channel 900 Detection Quiet Time Detect Hotspotter No Attack Hotspotter Quiet Time 900 Enable/disable detection of beacons advertising the incorrect channel. Time to wait in seconds after detecting an attempt of beacons advertising the incorrect channel, after which the check can be resumed. Enable/disable detection of the Hotspotter attack to lure away valid clients. Time to wait in seconds after detecting an attempt to use the Hotspotter tool against clients. 3. Select Add or Save. The added or edited Impersonation profile appears on the Profiles > IDS > Impersonation page. Profiles > IDS > Unauthorized Device Unauthorized device detection includes the ability to detect and disable rogue APs and other devices that can potentially disrupt network operations. The most important IDS functionality offered in the Dell PowerConnect W system is the ability to classify an AP as either a rogue AP or an interfering AP. An AP is considered to be a rogue AP if it is both unauthorized and plugged into the wired side of the network. An AP is considered to be an interfering AP if it is seen in the RF environment but is not connected to the wired network. While the interfering AP can potentially cause RF 86 | Dell PowerConnect W Configuration Reference Dell PowerConnect W AirWave 7.2 | Configuration Guide

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
86
|
Dell PowerConnect W Configuration Reference
Dell PowerConnect W AirWave 7.2
| Configuration Guide
3.
Select
Add
or
Save
.
The added or edited
Impersonation
profile appears on the
Profiles > IDS >
Impersonation
page.
Profiles > IDS > Unauthorized Device
Unauthorized device detection includes the ability to detect and disable rogue APs and other devices that can
potentially disrupt network operations.
The most important IDS functionality offered in the Dell PowerConnect W system is the ability to classify an AP
as either a rogue AP or an interfering AP. An AP is considered to be a rogue AP if it is both unauthorized and
plugged into the wired side of the network. An AP is considered to be an interfering AP if it is seen in the RF
environment but is not connected to the wired network. While the interfering AP can potentially cause RF
Protect from AP
Impersonation
No
When AP impersonation is detected, use this control to set both the legitimate and
impersonating AP to be disabled using a denial of service attack.
Beacon Diff Threshold
(0-100%)
50
Set the percentage increase in beacon rate that triggers an AP impersonation alert.
Beacon Increase Wait
Time
(0-360000 sec)
3
Set the time, in seconds, after the Beacon Diff Threshold is crossed before an AP
impersonation event is generated.
Detect Sequence
Anomaly
No
Enable or disable detection of anomalies between sequence numbers seen in 802.11
frames. During an impersonation attack, the attacker may spoof the MAC address of a
client or AP — if two devices are active on the network with the same MAC address, the
sequence numbers in the frames will not match since the sequence number is generated
by NIC firmware.
Sequence Number of
Difference
(0-100000)
300
Set the maximum allowable tolerance between sequence numbers within the Sequence
Number Time Tolerance period.
Sequence Number Time
Tolerance
(0-360000 sec)
300
Time, in seconds, during which sequence numbers must exceed the Sequence Number
Difference value for an alarm to be triggered.
Sequence Number
Quiet Time
(60-360000 sec)
900
After an alarm has been triggered, the time (in seconds) that must elapse before another
identical alarm may be triggered.
Detect AP Spoofing
Yes
Whether to detect AP Spoofing.
NOTE:
Requires a WIDS license.
AP Spoofing Quiet Time
900
Time to wait, in seconds, after a spoofing attempt to resume the check.
Detect Beacon Wrong
Channel
No
Enable/disable detection of beacons advertising the incorrect channel.
Beacon Wrong Channel
Detection Quiet Time
900
Time to wait in seconds after detecting an attempt of beacons advertising the incorrect
channel, after which the check can be resumed.
Detect Hotspotter
Attack
No
Enable/disable detection of the Hotspotter attack to lure away valid clients.
Hotspotter Quiet Time
900
Time to wait in seconds after detecting an attempt to use the Hotspotter tool against clients.
Table 33
Profiles > IDS > Impersonation Settings
(Continued)
Field
Default
Description