Administrator Guide

551 | Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.4.x| User Guide
Detecting an AirJack Attack
AirJack is a suite of device drivers for 802.11(a/b/g) raw frame injection and reception. It was intended to be
used as a development tool for all 802.11 applications that need to access the raw protocol. However, one of
the tools included allowing users to force all users off an AP.
Detecting ASLEAP
ASLEAP is a tool created for Linux systems used to attack Cisco LEAP authentication protocol.
Detecting a Null Probe Response
A null probe response attack has the potential to crash or lock up the firmware of many 802.11 NICs. In this
attack, a client probe-request frame will be answered by a probe response containing a null SSID. A number of
popular NIC cards will lock up upon receiving such a probe response.
Configuring Intrusion Protection
Intrusion protection features support containment of an AP or a client. In the case of an AP, we will attempt to
disconnect all clients that are connected or attempting to connect to the AP. In the case of a client, the client's
association to an AP is targeted. The following containment mechanisms are supported:
l Deauthentication containment: An AP or client is contained by disrupting its association on the wireless
interface.
l Tarpit containment: An AP is contained by luring clients that are attempting to associate with it to a
tarpit. The tarpit can be on the same channel as the AP being contained, or on a different channel (see Tarpit
Shielding Overview on page 564).
l Wired containment: An AP or client is contained by disrupting its connection on the wired interface.
The WIP feature supports separate enforcement policies that use the underlying containment mechanisms to
contain an AP or a client that do not conform to the policy. These policies are discussed in the sections that
follow.
Understanding Infrastructure Intrusion Protection
Table 109 presents a summary of the infrastructure intrusion protection features with their related
commands, traps, and syslog identifications. Details of each feature follow the table.