User`s manual

356
DWS-1008 User’s Manual
D-Link Systems, Inc.
Rogue Detection and Countermeasures
Enabling AP Signatures
An AP signature is a set of bits in a management frame sent by an AP that identies that AP to
MSS. If someone attempts to spoof management packets from a D-Link AP, MSS can detect
the spoof attempt.
AP signatures are disabled by default. To enable or disable them, use the following
command:
set rfdetect signature {enable | disable}
The command applies only to APs managed by the switch on which you enter the
command.
Disabling or Reenabling Logging of Rogues
By default, a DWS-1008 switch generates a log message when a rogue is detected or
disappears. To disable or reenable the log messages, use the following command:
set rfdetect log {enable | disable}
To display log messages on a switch, use the following command:
show log buffer
Enabling Rogue and Countermeasures Notications
By default, all SNMP notications (informs or traps) are disabled. To enable or disable
notications for rogue detection, Intrusion Detection System (IDS), and Denial of Service
(DoS) protection, congure a notication prole that sends all the notication types for these
features.
IDS and DoS Alerts
MSS can detect illegitimate network access attempts and attempts to disrupt network service.
In response, MSS generates messages and SNMP notications. The following sections
describe the types of attacks and security risks that MSS can detect.
Note: To detect DoS attacks, active scan must be enabled.