HP a-msr, Руководство по настройке

Страница: 54 / 73

50
A flood attack refers to the case where WLAN devices receive large volumes of frames of the same kind
within a short span of time. When this occurs, the WLAN devices are overwhelmed and, consequently, are
unable to service normal clients.
WIDS attacks detection counters flood attacks by constantly keeping track of the density of traffic generated
by each device. When the traffic density of a device exceeds the limit, the device is considered flooding the
network. If the dynamic blacklist feature is enabled, it is added to the blacklist and is forbidden to access the
WLAN for a period of time.
WIDS inspects the following types of frames:

Authentication requests and de-authentication requests

Association requests, disassociation requests, and reassociation requests
 Probe requests
 802.11 null data frames

802.11 action frames
Spoofing attack detection
In this kind of attack, a potential attacker can send frames in the air on behalf of another device. For instance,
a client in a WLAN has been associated with an AP and works normally. In this case, a spoofed
de-authentication frame can cause a client to get de-authenticated from the network. This can affect the
normal operation of the WLAN.
At present, spoofing attack detection counters this type of attack by detecting broadcast de-authentication
and disassociation frames sent on behalf of an AP. When such a frame is received, it is identified as a
spoofed frame, and the attack is immediately logged.
Weak IV detection
WEP uses an IV to encrypt each frame. An IV and a key are used to generate a key stream. Thus, encryptions
using the same key have different results. When a WEP frame is sent, the IV used in encrypting the frame is
also sent as part of the frame header.
However, if a WLAN device generates IVs in an insecure way, such as using a fixed IV for all frames, the
shared secret key may be exposed to any potential attackers. When the shared secret key is compromised,
the attacker can access network resources.
Weak IV detection counters this attack by verifying the IVs in WEP frames. Whenever a frame with a weak
IV is detected, it is logged immediately.
WLAN IDS configuration task list
Task Description
Configuring IDS attack detection
Displaying and maintaining
IDS attack detection
Optional
Configuring IDS attack detection
To configure IDS attack detection: