D-Link DWC-1000 User Manual page 304

Wireless Controller
In order to help determine whether a client is posing a threat to the network by
flooding the network with management traffic, the system keeps track of the number
of times the AP received each message type and the highest message rate detected in
a single RF Scan report. On the WIDS Client Configuration page, you can set
thresholds for each type of message sent, and the APs monitor whether any clients
exceed those thresholds or tests.
Not Present in OUI Database Test: This test checks whether the MAC address of
the client is from a registered manufacturer identified in the OUI database.
Known Client Database Test: This test checks whether the client, which is
identified by its MAC address, is listed in the Known Client Database and is allowed
access to the AP either through the Authentication Action of Grant or through the
White List global action. If the client is in the Known Client Database and has an
action of Deny, or if the action is Global Action and it is globally set to Black List,
the client fails this test.
Configured Authentication Rate Test : This test checks whether the client has
exceeded the configured rate for transmitting 802.11 authentication requests.
Configured Probe Requests Rate Test: This test checks whether the client has
exceeded the configured rate for transmitting probe requests.
Configured De-Authentication Requests Rate Test: This test checks whether the
client has exceeded the configured rate for transmitting de -authentication requests.
Maximum Authentication Failures Test: This test checks whether the client has
exceeded the maximum number of failed authentications.
Authentication with Unknown AP Test: This test checks whether a client in the
Known Client database is authenticated with an unknown AP.
Client Threat Mitigation: Select enable to send de-authentication messages to
clients that are in the Known Clients databa se but are associated with unknown APs.
The Authentication with Unknown AP Test must also be enabled in order for the
mitigation to take place. Select disable to allow clients in the Known Clients database
to remain authenticated with an unknown AP.
•
Probe Requests
•
802.11 Authentication Requests
•
802.11 De-Authentication Requests.
303
User Manual