Users Guide

490| Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.5.x| User Guide
Feature Command Trap
Syslog
ID
Detecting an
AirJack Attack
on page 492
ids signature-matching-profile
signature AirJack
ids general-profile
signature-quiet-time
wlsxNSignatureMatchAirjack 12604
6,
127046
Detecting
ASLEAP on
page 492
ids signature-matching-profile
signature ASLEAP
ids general-profile
signature-quiet-time
wlsxNSignatureMatchAsleap 12604
4,
127044
Detecting a
Null Probe
Response on
page 492
ids signature-matching-profile
signature Null Probe Response
ids general-profile
signature-quiet-time
wlsxNSignatureMatchNullProbeRe
sp
12604
5,
127045
Detecting a Block ACK DoS
The Block ACK mechanism that was introduced in 802.11e, and enhanced in 802.11nD3.0, has a built-in DoS
vulnerability. The Block ACK mechanism allows for a sender to use the ADDBA request frame to specify the
sequence number window that the receiver should expect. The receiver will only accept frames in this window.
An attacker can spoof the ADDBA request frame causing the receiver to reset its sequence number window
and thereby drop frames that do not fall in that range.
Detecting a ChopChop Attack
ChopChop is a plaintext recovery attack against WEP encrypted networks. It works by forcing the plaintext, one
byte at a time, by truncating a captured frame and then trying all 256 possible values for the last byte with a
corrected CRC. The correct guess causes the AP to retransmit the frame. When that happens, the frame is
truncated again.
Detecting a Disconnect Station Attack
A disconnect attack can be launched in many ways; the end result is that the client is effectively and repeatedly
disconnected from the AP.
Detecting an EAP Rate Anomaly
To authenticate wireless clients, WLANs may use 802.1X, which is based on a framework called Extensible
Authentication Protocol (EAP). After an EAP packet exchange, and the user is successfully authenticated, the
EAP-Success is sent from the AP to the client. If the user fails to authenticate, an EAP-Failure is sent. In this
attack, EAP-Failure or EAP-Success frames are spoofed from the access point to the client to disrupting the
authentication state on the client. This confuses the client’s state, causing it to drop the AP connection. By
continuously sending EAP Success or Failure messages, an attacker can effectively prevent the client from
authenticating with the APs in the WLAN.
Detecting a FATA-Jack Attack Structure
FATA-Jack is an 802.11 client DoS tool that tries to disconnect targeted stations using spoofed authentication
frames that contain an invalid authentication algorithm number.