Aruba Networks AirOS v2.3, User Manual

Page: 169 / 254

Intrusion Detection 159
Chapter 10
Adding a New Signature Pattern
To add new signatures in addition to the pre-defined signatures described above,
follow the steps below:
1 On the
Configuration > WLAN Intrusion Detection > Signatures
page, click
Add
to
start adding a new signature pattern.
3. AirJack An attack with the potential to crash or lock up
the firmware of many 802.11 NICs. In this
attack, a client probe-request frame will be
answered by a probe response containing a null
SSID. A number of popular NIC cards will lock
up upon receiving such a probe response.
4. NetStumbler Generic NetStumbler is a popular wardriving application
used to locate 802.11 networks. When used with
certain NICs (such as Orinoco), NetStumbler
generates a characteristic frame that can be
detected.
5. NetStumbler Version 3.3.0x Version 3.3.0 of NetStumbler changed the
characteristic frame slightly. This signature
detects the updated frame.
6. Deauth-Broadcast A deauth broadcast attempts to disconnect all
stations in range – rather than sending a spoofed
deauth to a specific MAC address, this attack
sends the frame to a broadcast address.