NETGEAR ProSafe Premium WNDAP620 Reference Manual page 91

ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP620
Table 24. IDS/IPS policies and policy rules (continued)
Policy Description
EAPOL-start attack • Attack. Multiple EAPOL start frames (5 or more) are sent to the
wireless access point to initiate the RADIUS authentication
process for clients.
• Result. Wireless service is disrupted.
• Solution. The wireless access point determines if the legitimate
clients have already been authenticated before processing
EAPOL start frames.
EAPOL-logoff attack • Attack. Several EAPOL logoff frames (2 or more) that use the
spoofed MAC address of a legitimate client are sent to the
wireless access point to terminate a RADIUS-authenticated
session.
• Result. The client is disconnected from the wireless access
point.
• Solution. The wireless access point determines if it still
receives traffic from the client before disconnecting the client.
Premature EAP • Attack. Several premature EAP failure frames (2 or more) are
failure attack sent to a legitimate client to suggest RADIUS authentication
failure.
• Result. The client cannot be authenticated and cannot connect
to the wireless access point.
Note:
against this attack.
Premature EAP • Attack. Several premature EAP success frames (2 or more) are
success attack sent to a legitimate client to suggest RADIUS authentication
success.
• Result. The client cannot be authenticated and cannot connect
to the wireless access point.
Note:
against this attack.
CTS flood • Attack. Multiple clear-to-send (CTS) frames (60 or more) are
sent to the wireless access point.
• Result. Wireless service is disrupted.
• Solution. The wireless access point sends a channel change
frame to the legitimate clients and uses automatic channel
selection to switch to a new clear channel.
RTS flood • Attack. Multiple request-to-send (RTS) frames (60 or more) are
sent to the wireless access point.
• Result. Wireless service is disrupted.
• Solution. The wireless access point sends a channel change
frame to the legitimate clients and uses automatic channel
selection to switch to a new clear channel.
The IDS detects this attack, but the IPS does not take action
The IDS detects this attack, but the IPS does not take action
Management and Monitoring
91
Policy Rule
Threshold Notification
5 Trap
2 Trap
2 Trap
2 Trap
60 Trap
60 Trap