NETGEAR ProSafe Premium WNDAP660 Reference Manual page 91

ProSafe Premium 3 x 3 Dual-Band Wireless-N Access Point WNDAP660
Table 24. IDS/IPS policies and policy rules (continued)
Policy Description
Disassociation flood • Attack. Multiple disassociation frames (5 or more) that use the
spoofed MAC address of the wireless access point are sent to a
legitimate client.
• Result. The client is disconnected from the wireless access
point.
Note:
against this attack.
Malformed 802.11 • Detection. Multiple malformed packets (5 or more) are sent to
packets detected the wireless access point.
• Result. Clients behave unexpectedly or crash.
• Solution. The wireless access point drops the malformed
packets.
EAPOL-start attack • Attack. Multiple EAPOL start frames (5 or more) are sent to the
wireless access point to initiate the RADIUS authentication
process for clients.
• Result. Wireless service is disrupted.
• Solution. The wireless access point determines if the legitimate
clients have already been authenticated before processing
EAPOL start frames.
EAPOL-logoff attack • Attack. Several EAPOL logoff frames (2 or more) that use the
spoofed MAC address of a legitimate client are sent to the
wireless access point to terminate a RADIUS-authenticated
session.
• Result. The client is disconnected from the wireless access
point.
• Solution. The wireless access point determines if it still
receives traffic from the client before disconnecting the client.
Premature EAP • Attack. Several premature EAP failure frames (2 or more) are
failure attack sent to a legitimate client to suggest RADIUS authentication
failure.
• Result. The client cannot be authenticated and cannot connect
to the wireless access point.
Note:
against this attack.
Premature EAP • Attack. Several premature EAP success frames (2 or more) are
success attack sent to a legitimate client to suggest RADIUS authentication
success.
• Result. The client cannot be authenticated and cannot connect
to the wireless access point.
Note:
against this attack.
The IDS detects this attack, but the IPS does not take action
The IDS detects this attack, but the IPS does not take action
The IDS detects this attack, but the IPS does not take action
Management and Monitoring
91
Policy Rule
Threshold Notification
5 Trap
5 Trap
5 Trap
2 Trap
2 Trap
2 Trap