Wids Configuration - Motorola WS2000 - Wireless Switch - Network Management Device System Reference Manual

WIDS also keep track of anomalies. An anomaly is defined as an event which is different from the general
occurrences on a WS2000. The following anomalies are tracked:
• null-dst - NULL destination
• same-src-dst - Same source and destination address
• mcast-src - Source MAC is multicast
• weak-wep-iv - Weak WEP
• tkip-cntr-meas - TKIP counter measures
• invalid-frame-len - Invalid frame length

5.11.1 WIDS Configuration

The WIDS parameters for violations and anomalies can be configured from the
WIDS screen. The tab is enabled when the
To configure WIDS:
1. Enter a time value in seconds for the
detect window value. For example, if the value is 30 seconds, WIPS checks for violations and anomalies
every 30 seconds.
5.11.1.1 Excessive Violation Parameters
Use the Excessive Violation Parameters
threshold values can be set for MUs, Radio, and Switch.
To set the Excessive Violation Parameter value:
1. Click on the violation that you want to monitor.
2. If you would like to monitor the MU for a violation, click under the MU Threshold column for that violation.
The column becomes editable. Enter a suitable value for the threshold. You can similarly set the
thresholds for the Radio as well as the Switch for the violation.
3. Use the Time to Filter
will be filtered out. For example, if this value is set to 135 seconds, the MU is filtered out for 135 seconds.
The Radio Threshold
reaching which a SNMP trap is generated.
5.11.1.2 Anomaly Violation Parameters
Use the Anomaly Violation Parameters section to set the parameters for Anomalies. When enabled, the MU
is filtered out for the duration specified in the
1. Enable or disable Anomaly Violation detection by selecting the
2. Use the Time to Filter
will be filtered out. For example, if this value is set to 135 seconds, the MU is filtered out for 135 seconds.
3. Click the Apply
screen without clicking the
Enable WIDS
Detect
section to set violation parameters. Violation parameters
column to set the time duration during which any packets received from the MU
and Switch Threshold
Time to Filter
column to set the time duration during which any packets received from the MU
button to save any changes made on this screen. Navigating away from the current
Apply button results in all changes to this screen being lost.
checkbox is selected.
Window. WIPS checks for violations and anomalies every
columns enables you to set up threshold values upon
column.
MU Threshold
5-39
Wireless Configuration
Configuration tab of the
checkbox.