Wireless Intrusion Detection System - Motorola WS2000 - Wireless Switch - Network Management Device System Reference Manual

5-38 WS2000 Wireless Switch System Reference Guide

5.11 Wireless Intrusion Detection System

The Motorola Wireless Intrusion Detection System (WIDS) protects against a wide range of malicious
attacks on the WS2000 Wireless Switch. This feature inspects each packet that is received by the WS2000
and then based on analysis decides if an intrusion is happening on the device.
By default, WIDS is disabled. It can be enabled from the
screen.
For WIDS a violation is when excessive numbers of packets of the same type are received.
WIDS keeps track of each packet type that is received and when a threshold value is crossed, raises a
violation alarm. Appropriate action can be performed based on the alerts. WIDS provides alerts when
thresholds are crossed for:
• MUs
• Radio
• Switch
WIDS keeps tracks of these violations:
• probe-req - Probe Requests
• auth-assoc-req - Authentication Association Requests
• deauth-deassoc-req - Deauthentication De-association Requests
• auth-fails - Authentication Failures
• crypto-replay - Cryptography Replays
• 802.11-replay - 802.11x Replays
• decrypt-fails - Decryption Failures
• unassoc-frames - Unassociated Frames
• eap-starts - EAP Start Frames
[Network Configuration]-->Wireless-->WIDS