Netgear WNDAP660 Reference Manual - Page 90

Table 24., IDS/IPS policies and policy rules, Policy, Description, Policy Rule, Attack, Result

Get Netgear WNDAP660 PDF manuals and user guides View all Netgear WNDAP660 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 90 highlights

ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP660 Table 24. IDS/IPS policies and policy rules Policy Description Policy Rule Threshold Notification Authentication flood • • • Attack. Multiple authentication requests (5 or more) that use 5 spoofed MAC addresses of legitimate clients are sent to the wireless access point. Result. The client association table overflows, causing authentication requests from legitimate clients to be denied. Solution. The oldest clients that are stuck in the authentication phase are removed from the table. Trap Association flood • Attack. Multiple association requests (5 or more) that use 5 spoofed MAC addresses of legitimate clients are sent to the wireless access point. • Result. The client association table overflows, causing association requests from legitimate clients to be denied. • Solution. The oldest associations are removed from the table. Trap Unauthenticated association • Attack. Multiple unauthenticated association requests (5 or 5 more) that use spoofed MAC addresses of legitimate clients are sent to the wireless access point. • Result. The client association table overflows, causing authentication requests from legitimate clients to be denied. • Solution. The oldest clients that are stuck in the authentication phase are removed from the table. Trap Association table overflow • Attack. Multiple clients (5 or more) that use spoofed MAC 5 addresses of legitimate clients attempt to connect to the wireless access point. • Result. The client association table overflows, causing association requests from legitimate clients to be denied. • Solution. The oldest associations are removed from the table. Trap Authentication failure attack • Attack. Multiple invalid authentication requests (5 or more) that 5 use the spoofed MAC address of a legitimate client are sent to the wireless access point. • Result. The client is disconnected from the wireless access point. • Solution. The wireless access point determines if the legitimate client is already connected before processing an authentication request. Trap Deauthentication broadcast attack • Attack. Multiple deauthentication frames (5 or more) that use 5 the spoofed MAC address of the wireless access point are sent to legitimate clients. • Result. Clients are disconnected from the wireless access point. Trap Note: The IDS detects this attack, but the IPS does not take action against this attack. Management and Monitoring 90

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
Management and Monitoring
90
ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP660
Table 24.
IDS/IPS policies and policy rules
Policy
Description
Policy Rule
Threshold
Notification
Authentication flood
•
Attack
. Multiple authentication requests (5 or more) that use
spoofed MAC addresses of legitimate clients are sent to the
wireless access point.
•
Result
. The client association table overflows, causing
authentication requests from legitimate clients to be denied.
•
Solution
. The oldest clients that are stuck in the authentication
phase are removed from the table.
5
Trap
Association flood
•
Attack
. Multiple association requests (5 or more) that use
spoofed MAC addresses of legitimate clients are sent to the
wireless access point.
•
Result
. The client association table overflows, causing
association requests from legitimate clients to be denied.
•
Solution
. The oldest associations are removed from the table.
5
Trap
Unauthenticated
association
•
Attack
. Multiple unauthenticated association requests (5 or
more) that use spoofed MAC addresses of legitimate clients are
sent to the wireless access point.
•
Result
. The client association table overflows, causing
authentication requests from legitimate clients to be denied.
•
Solution
. The oldest clients that are stuck in the authentication
phase are removed from the table.
5
Trap
Association table
overflow
•
Attack
. Multiple clients (5 or more) that use spoofed MAC
addresses of legitimate clients attempt to connect to the
wireless access point.
•
Result
. The client association table overflows, causing
association requests from legitimate clients to be denied.
•
Solution
. The oldest associations are removed from the table.
5
Trap
Authentication
failure attack
•
Attack
. Multiple invalid authentication requests (5 or more) that
use the spoofed MAC address of a legitimate client are sent to
the wireless access point.
•
Result
. The client is disconnected from the wireless access
point.
•
Solution
. The wireless access point determines if the legitimate
client is already connected before processing an authentication
request.
5
Trap
Deauthentication
broadcast attack
•
Attack
. Multiple deauthentication frames (5 or more) that use
the spoofed MAC address of the wireless access point are sent
to legitimate clients.
•
Result
. Clients are disconnected from the wireless access
point.
Note:
The IDS detects this attack, but the IPS does not take action
against this attack.
5
Trap