Intrusion Detection System (Ids) Alarms - 3Com WX4400 Reference Manual

402 C 14: M
HAPTER ANAGING
Intrusion Detection
System (IDS) Alarms
A
LARMS
SNMP notifications must be enabled on the WX switches. Table 28 lists
the notification types for Intrusion Detection System (IDS) and Denial of
Service (DoS) protection. (For more information about DoS notification,
see "Denial of Service (DoS) Alarms" on page 404. To enable
notifications on a switch, see "Configuring SNMP" on page 196.)
Table 28 SNMP Notifications for IDS and DoS
Notification Type
IDS/DoS notifications
For more information about IDS/DoS, see the "IDS and DoS Alerts" section in the
"Rogue Detection and Countermeasures" chapter of the
Controller Configuration
CounterMeasureStart
CounterMeasureStop
RFDetectSpoofedMacAP
RFDetectSpoofedSSIDAP
RFDetectDoS
RFDetectDoSPort
RFDetectClientViaRogueWiredAP
1 To view IDS alarms in chart format, click the Chart icon at the bottom left
corner of the IDS Alarms section of the 3WXM screen.
IDS fault information displays, shown as follows.
Description
Guide.
Indicates that MSS has begun
countermeasures against a rogue AP.
Indicates that MSS has stopped
countermeasures against a rogue access
point.
Indicates that MSS has detected a wireless
packet with the source MAC address of a
MAP, but without the spoofed signature
(fingerprint) for the MAP
Indicates that MSS has detected beacon
frames for a valid SSID, but sent by a
rogue AP.
Indicates that MSS has detected a DoS
attack other than an associate request
flood, reassociate request flood, or
disassociate request flood.
Indicates that MSS has detected an
associate request flood, reassociate
request flood, or disassociate request
flood.
Indicates that MSS has detected, on the
wired part of the network, the MAC
address of a wireless client associated
with a third-party AP.
Wireless LAN Switch and