User's Guide

Threshold Description
Low Speed Frames % 802.11 protocols operate on a shared medium and use collision
avoidance mechanism to access this medium. Excessive use of
lower rates for transmitting frames is likely caused by stations
which are either misconfigured to use lower rates or are too far
from the APs to be able to support higher rates and cause alarms to
be generated.
Enter the maximum percentage of data per minute allowed for low
speed frames to be transmitted or received from all stations. If
AirDefense detects a greater number, it generates an alarm.
Default = 0.
Layer 3 Multicast Frames % An alarm that is generated when the system has detected a high
percentage of multicast trac violating the policy thresholds. This
may be a result of potential Layer 3 broadcast storm attacks on the
network.
Enter the maximum percentage of data per minute allowed for
multicast frames to be transmitted or received within a BSS from all
stations. If AirDefense detects a greater number, it generates an
alarm.
Default = 0.
Layer 3 Broadcast Frames % An alarm that is generated when the system has detected a high
percentage of broadcast trac violating the policy thresholds. This
may be a result of potential Layer 3 broadcast storm attacks on the
network.
Enter the maximum percentage of data per minute allowed for
broadcast frames to be transmitted or received within a BSS from
all stations. If AirDefense detects a greater number, it generates an
alarm.
Default = 0.
Retransmission Frames % Enter the maximum percentage of retransmitted data frames
allowed during a transmission of data within a BSS from all stations.
If AirDefense detects a greater number, it generates an alarm.
Default = 0.
PS Poll Frames Seen An alarm is generated by a DOS attack using an excessive number
of PS-POLL frames have been detected.
Enter the maximum number of PS Poll frames to be seen within a
BSS. If AirDefense detects a greater number, it generates an
alarm.Default = 0.
Wireless Clients Tab
The Wireless Clients tab is where you assign BSS thresholds that apply to any individual Wireless Client.
These thresholds will typically be lower than the aggregate Wireless Client thresholds. AirDefense
generates an alarm if any single Wireless Client reaches one of these thresholds. From these alarms, you
can identify the high bandwidth users, and the times they are using the network. You should base
Wireless Client thresholds on either the normal transmission rate for your wireless LAN, or on arbitrary
numbers designed to detect your high-bandwidth users..
Note
Entering a 0 (zero) for any threshold-type disables that specific alarm.
Legacy Content Network Assurance
Extreme AirDefense User Guide for version 10.5. 1089