Administrator Guide

547 | Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.4.x| User Guide
Understanding Client Intrusion Detection
Generally, clients are more vulnerable to attacks than APs. Clients are more apt to associate with a malignant
AP due to the client’s driver behavior or a misconfigured client. It is important to monitor authorized clients to
track their associations and to track any attacks raised against the client.Client attack detection is categorized
as:
l Detecting attacks against Dell APs clients: An attacker can perform an active DOS attack against an
associated client, or perform a replay attack to obtain the keys of transmission which could lead to more
serious attacks.
l Monitoring Authorized clients: Since clients are easily tricked into associating with unauthorized APs,
tracking all misassociations of authorized clients is very important.
An authorized client is a client authorized to use the WLAN network. In ArubaOS, an authorized client is called a
valid-client. ArubaOS automatically learns a valid client. A client is determined to be valid if it is associated to an
authorized or valid AP using encryption; either Layer 2 or IPSEC.
Detection of attacks is limited to valid clients and clients associated to valid APs. Clients that are associated as guests
using unencrypted association are included in the attack detection. However, clients on neighboring (interfering) APs
are not tracked for attack detection unless they are specified as valid.
Table 108 presents a summary of the client intrusion detection features with their related commands, traps,
and syslog identification. Details of each feature follow the table.
Feature Command Trap
Syslog
ID
Detecting a
Block ACK
DoS on page
549
ids-dos-profile
detect-block-ack-attack
block-ack-quiet-time
wlsxBlockAckAttackDetected 12608
7,
127087
Detecting a
ChopChop
Attack on
page 549
ids-dos-profile
detect-chopchop-attack
chopchop-quiet-time
wlsxChopChopAttackDetected 12607
8,
127078
Detecting a
Disconnect
Station Attack
on page 549
ids dos-profile <name>
detect-disconnect-sta
disconnect-sta-quiet-time
disconnect-sta-assoc-resp-threshold
disconnect-deauth-disassoc-threshold
wlsxNDisconnectStationAttack 12603
5,
127035
Detecting an
EAP Rate
Anomaly on
page 549
ids-dos-profile
detect-eap-rate-anomaly
eap-rate-threshold
eap-rate-time-interval
eap-rate-quiet-time
wlsxEAPRateAnomaly 12603
2,
127032
Detecting a
FATA-Jack
Attack
Structure on
page 549
ids dos-profile
detect-fatajack-attack
fatajack-attack-quiet-time
wlsxFataJackAttackDetected 12607
2,
127072
Table 108: Client Detection Summary