Filter
Top Products
Management and Monitoring
93
ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP620
Known client
associating with
ad-hoc network
• Detection. Clients that should be connected to the secured
wireless network are instead connected to wireless access
points that are part of an ad hoc network.
• Res
ult. Wireless security might be compromised.
• Solution.
The clients are disconnected from the ad hoc
network.
0 Trap
AP property
ch
anged
• Detection. Unauthorized changes such as a change of SSID,
security settings, or channel are made on a known wireless
access point in the network.
• Res
ult. Wireless security is compromised and clients cannot
connect to the wireless access point.
Note: The IDS detects that the properties of a known wireless
access poi
nt in the network are changed, but the IPS does not take
action.
The changes that the IDS detects are listed in a table. The affected
wirel
ess access point is identified by its MAC address. To correct
the situation, access the web management interface of the affected
wireless access point, and reverse the changes.
To remove the detected chan
ges from the table:
1. Select the check box to the left of the wireless access point for
which
you want to remove the changes from the table.
2. Above the table, click Delete.
0 Trap
Device probing for
access point
s
• Detection. Multiple probe requests (30 or more) are sent to
collect information about the wireless access point for possible
future attacks. For example, it is suspect when there are too
many probe requests with a different SSID from same MAC
address.
• Res
ult. An attack might occur, or wireless security might
become compromised.
• Solution. The
wireless access point does not respond to probe
requests that do not contain its SSID.
30 Trap
PS poll flood attack • Attack. Multiple power save (PS)–Poll frames (50 or more) are
sent to the wireless access point from an address that has a
spoofed MAC address of a legitimate client.
• Res
ult. Traffic that is intended for the legitimate client is sent to
the attacking address and is lost.
• Solution. PS-Poll
frames without a corresponding traffic
indication map (TIM) are rejected.
50 Trap
Table 24. IDS/IPS policies and policy rules (continued)
Policy Description Policy Rule
Threshold Notification