Dell W-7030 AOS 6.4.x User Guide - Page 547

Understanding Client Intrusion Detection Generally, clients are more vulnerable to attacks than APs. Clients are more apt to associate with a malignant AP due to the client's driver behavior or a misconfigured client. It is important to monitor authorized clients to track their associations and to track any attacks raised against the client.Client attack detection is categorized as: l Detecting attacks against Dell APs clients: An attacker can perform an active DOS attack against an associated client, or perform a replay attack to obtain the keys of transmission which could lead to more serious attacks. l Monitoring Authorized clients: Since clients are easily tricked into associating with unauthorized APs, tracking all misassociations of authorized clients is very important. An authorized client is a client authorized to use the WLAN network. In ArubaOS, an authorized client is called a valid-client. ArubaOS automatically learns a valid client. A client is determined to be valid if it is associated to an authorized or valid AP using encryption; either Layer 2 or IPSEC. Detection of attacks is limited to valid clients and clients associated to valid APs. Clients that are associated as guests using unencrypted association are included in the attack detection. However, clients on neighboring (interfering) APs are not tracked for attack detection unless they are specified as valid. Table 108 presents a summary of the client intrusion detection features with their related commands, traps, and syslog identification. Details of each feature follow the table. Table 108: Client Detection Summary Feature Command Trap Detecting a Block ACK DoS on page 549 ids-dos-profile detect-block-ack-attack block-ack-quiet-time wlsxBlockAckAttackDetected Detecting a ChopChop Attack on page 549 ids-dos-profile detect-chopchop-attack chopchop-quiet-time wlsxChopChopAttackDetected Detecting a Disconnect Station Attack on page 549 ids dos-profile detect-disconnect-sta disconnect-sta-quiet-time disconnect-sta-assoc-resp-threshold disconnect-deauth-disassoc-threshold wlsxNDisconnectStationAttack Detecting an EAP Rate Anomaly on page 549 ids-dos-profile detect-eap-rate-anomaly eap-rate-threshold eap-rate-time-interval eap-rate-quiet-time wlsxEAPRateAnomaly Detecting a FATA-Jack Attack Structure on page 549 ids dos-profile detect-fatajack-attack fatajack-attack-quiet-time wlsxFataJackAttackDetected Syslog ID 12608 7, 127087 12607 8, 127078 12603 5, 127035 12603 2, 127032 12607 2, 127072 547 | Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.4.x | User Guide