Netgear WNDAP620 Reference Manual - Page 92

Attack, Result, Solution, Detection, Policy, Description, Policy Rule

Get Netgear WNDAP620 PDF manuals and user guides View all Netgear WNDAP620 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 92 highlights

ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP620 Table 24. IDS/IPS policies and policy rules (continued) Policy Description Policy Rule Threshold Notification RF jamming attack • Attack. Multiple RF transmissions (100 or more) are sent to the 100 wireless access point, jamming the radio frequency. • Result. Wireless service is disrupted. Trap Note: The IDS detects this attack, but the IPS does not take action against this attack. Virtual carrier attack • • • Attack. Multiple frames (60 or more) with a large duration value 60 are sent to the wireless access point. Result. Wireless service is disrupted. Solution. The wireless access point sends a channel change frame to the legitimate clients and uses automatic channel selection to switch to a new clear channel. MAC spoofing • Attack. Several frames (3 or more) that contain the spoofed 3 MAC address of the wireless access point itself or the spoofed MAC address of a legitimate client are sent to the wireless access point. • Result. Wireless security might be compromised. Trap Trap Note: The IDS detects MAC spoofing, but the IPS does not take action against MAC spoofing. Rogue AP detection • • Detection. A wireless access point is not in the managed AP 0 list (see View and Save Access Point Lists on page 87) and is not connected to the secured wireless or wired network. Result. Wireless security might be compromised. Trap Ad-hoc network detected Note: The IDS detects rogue APs, but the IPS does not take action against rogue APs. For information about how to exclude rogue APs from your network, see Enable Rogue AP Detection and Monitor Access Points on page 85. • Detection. A group of wireless access points are part of an 0 ad hoc network that might broadcast the same SSID as the secured wireless network. • Result. Wireless security might be compromised. Trap Note: The IDS detects ad hoc networks, but the IPS does not take action against ad hoc networks. Ad-hoc network with • Detection. A group of wireless access points are part of an 0 wired connectivity ad hoc network that has a wired connection and that might broadcast the same SSID as the secured wireless network. • Result. Wireless security might be compromised. Trap Note: The IDS detects ad hoc networks, but the IPS does not take action against ad hoc networks. Management and Monitoring 92

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
Management and Monitoring
92
ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP620
RF jamming attack
•
Attack
. Multiple RF transmissions (100 or more) are sent to the
wireless access point, jamming the radio frequency.
•
Result
. Wireless service is disrupted.
Note:
The IDS detects this attack, but the IPS does not take action
against this attack.
100
Trap
Virtual carrier attack
•
Attack
. Multiple frames (60 or more) with a large duration value
are sent to the wireless access point.
•
Result
. Wireless service is disrupted.
•
Solution
. The wireless access point sends a channel change
frame to the legitimate clients and uses automatic channel
selection to switch to a new clear channel.
60
Trap
MAC spoofing
•
Attack
. Several frames (3 or more) that contain the spoofed
MAC address of the wireless access point itself or the spoofed
MAC address of a legitimate client are sent to the wireless
access point.
•
Result
. Wireless security might be compromised.
Note:
The IDS detects MAC spoofing, but the IPS does not take
action against MAC spoofing.
3
Trap
Rogue AP detection
•
Detection
. A wireless access point is not in the managed AP
list (see
View and Save Access Point Lists
on page 87) and is
not connected to the secured wireless or wired network.
•
Result
. Wireless security might be compromised.
Note:
The IDS detects rogue APs, but the IPS does not take action
against rogue APs. For information about how to exclude rogue APs
from your network, see
Enable Rogue AP Detection and Monitor
Access Points
on page 85.
0
Trap
Ad-hoc network
detected
•
Detection
. A group of wireless access points are part of an
ad hoc network that might broadcast the same SSID as the
secured wireless network.
•
Result
. Wireless security might be compromised.
Note:
The IDS detects ad hoc networks, but the IPS does not take
action against ad hoc networks.
0
Trap
Ad-hoc network with
wired connectivity
•
Detection
. A group of wireless access points are part of an
ad hoc network that has a wired connection and that might
broadcast the same SSID as the secured wireless network.
•
Result
. Wireless security might be compromised.
Note:
The IDS detects ad hoc networks, but the IPS does not take
action against ad hoc networks.
0
Trap
Table 24.
IDS/IPS policies and policy rules (continued)
Policy
Description
Policy Rule
Threshold
Notification