User Guide

Intrusion Detection 175
Chapter 13
Adding a New Signature Pattern
To add new signatures in addition to the pre-defined signatures described
above, follow the steps below:
1. On the
Configuration > Wireless LAN Intrusion Detection > Signatures page,
click Add to start adding a new signature pattern.
3. AirJack Originally a suite of device drivers for
802.11(a/b/g) raw frame injection and
reception. It was intended to be used as a
development tool for all 802.11 applications
that need to access the raw protocol.. Alas,
one of the tools included allowed users to
force off all users on an Access Point.
4. NetStumbler Generic NetStumbler is a popular wardriving
application used to locate 802.11 networks.
When used with certain NICs (such as
Orinoco), NetStumbler generates a
characteristic frame that can be detected.
5. NetStumbler Version 3.3.0x Version 3.3.0 of NetStumbler changed the
characteristic frame slightly. This signature
detects the updated frame.
6. Deauth-Broadcast A deauth broadcast attempts to disconnect
all stations in range – rather than sending a
spoofed deauth to a specific MAC address,
this attack sends the frame to a broadcast
address.