Dell W-7030 AOS 6.4.x User Guide - Page 549

Feature Command Detecting an AirJack Attack on page 551 ids signature-matching-profile signature AirJack ids general-profile signature-quiet-time Detecting ASLEAP on page 551 ids signature-matching-profile signature ASLEAP ids general-profile signature-quiet-time Detecting a Null Probe Response on page 551 ids signature-matching-profile signature Null Probe Response ids general-profile signature-quiet-time Trap wlsxNSignatureMatchAirjack Syslog ID 12604 6, 127046 wlsxNSignatureMatchAsleap 12604 4, 127044 wlsxNSignatureMatchNullProbeRe sp 12604 5, 127045 Detecting a Block ACK DoS The Block ACK mechanism that was introduced in 802.11e, and enhanced in 802.11nD3.0, has a built-in DoS vulnerability. The Block ACK mechanism allows for a sender to use the ADDBA request frame to specify the sequence number window that the receiver should expect. The receiver will only accept frames in this window. An attacker can spoof the ADDBA request frame causing the receiver to reset its sequence number window and thereby drop frames that do not fall in that range. Detecting a ChopChop Attack ChopChop is a plaintext recovery attack against WEP encrypted networks. It works by forcing the plaintext, one byte at a time, by truncating a captured frame and then trying all 256 possible values for the last byte with a corrected CRC. The correct guess causes the AP to retransmit the frame. When that happens, the frame is truncated again. Detecting a Disconnect Station Attack A disconnect attack can be launched in many ways; the end result is that the client is effectively and repeatedly disconnected from the AP. Detecting an EAP Rate Anomaly To authenticate wireless clients, WLANs may use 802.1x, which is based on a framework called Extensible Authentication Protocol (EAP). After an EAP packet exchange, and the user is successfully authenticated, the EAP-Success is sent from the AP to the client. If the user fails to authenticate, an EAP-Failure is sent. In this attack, EAP-Failure or EAP-Success frames are spoofed from the access point to the client to disrupting the authentication state on the client. This confuses the client's state, causing it to drop the AP connection. By continuously sending EAP Success or Failure messages, an attacker can effectively prevent the client from authenticating with the APs in the WLAN. Detecting a FATA-Jack Attack Structure FATA-Jack is an 802.11 client DoS tool that tries to disconnect targeted stations using spoofed authentication frames that contain an invalid authentication algorithm number. 549 | Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.4.x | User Guide