Motorola WiNG 4.4, Reference Manual, Page: 366 / 598

6 - 14 WiNG 4.4 Switch System Reference Guide
3. Select a detected MU and click the Delete button to remove it from the list of MUs you are tracking as potential threats
within the switch managed network.
4. Click on the Export button to export the contents of the table to a Comma Separated Values file (CSV).
Violation Type Displays the reason the violation occurred for each detected MU. Use the Violation Type to discern
whether the detected MU is truly a threat on the switch managed network (and must be removed)
or can be interpreted as a non threat. The following violation types are possible:
• Excessive Probes
• Excessive Association
• Excessive Disassociation
• Excessive Authentication failure
• Excessive Crypto replays
• Excessive 802.11 replays
• Excessive Decryption failures
• Excessive Unassociated Frames
• Excessive EAP Start Frames
• Null destination
• Same source/destination MAC
• Source multicast MAC
• Weak WEP IV
• TKIP Countermeasures
• Invalid Frame Length
• Excessive EAP-NAKS
• Invalid 802.1x frames
• Invalid Frame Type
• Beacon with broadcast ESSID
• Frames with known bad ESSIDs
• Unencrypted traffic
• Frames with non-changing WEP IV
• Detect Adhoc Networks
• De-auth from broadcast smac
• Invalid Sequence Number
NOTE : The following violation types require the Access Port be in scan mode:
• Beacon with broadcast ESSID
• Frames with known bad ESSIDs
Time Remaining Displays the time remaining before the next filter activity. Detected MUs are removed from the
filtered list when they no longer violate the thresholds defined within the Configuration tab.