Users Guide

506| Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.5.x| User Guide
These settings are configured via the command rfam-scan-profile, which can be attached to the two profiles,
dot11a-radio-profile and dot11g-radio-profile.
The am-scan-profile includes the following parameters that can be configured:
rf am-scan-profile <name>
scan-mode [reg-domain | all-reg-domain | rare]
The default setting is the all-reg-domain. This is consistent with the default functioning of the AM scanning
where the radio scans channels belonging to all regulatory domains.
Configuring Per AP Setting
If the AP is a dual-band single radio AP, an option is available to specify which band should be used for scanning
in AM-mode. This setting is available in the ap system-profile, via the am-scan-rf-band command.
ap system-profile <name>
am-scan-rf-band [a | g | all]
The default value is “all”, which is consistent with the prior behavior. This setting is ignored in the case of a dual
radio AP.
There are four parameters that will control the age out of devices in the AM module.
ids general-profile <name>
ap-inactivity-timeout
sta-inactivity-timeout
ap-max-unseen-timeout
sta-max-unseen-timeout
The inactivity timeout is the number of times the device was not “seen” when the channel was scanned. The
unseen timeout is the time, in seconds, since the device was last “seen.”
The show ap monitor scan-info/channel commands provide details of the channel types, dwell times, and
the channel visit sequence.
(host) # show ap monitor scan-info ap-name rb-121
Licensing
The ability to perform rare scanning is available only with the RFprotect license. However, the AP can scan ‘reg-
domain’ or ‘all-reg-domain’ channels without the RFprotect license.
Tarpit Shielding Overview
The Tarpit Shielding feature is a type of wireless containment. Detected devices that are classified as rogues are
contained by forcing client association to a fake channel or BSSID. This method of tarpitting is more efficient
than rogue containment via repeated de-authorization requests. Tarpit Sheilding works by spoofing frames
from an AP to confuse a client about its association. The confused client assumes it is associated to the AP on a
different (fake) channel than the channel that the AP is actually operating on, and will attempt to communicate
with the AP in the fake channel.
Tarpit Shielding works in conjunction with the deauth wireless containment mechanism. The deauth
mechanism triggers the client to generate probe request and subsequent association request frames. The AP
then responds with probe response and association response frames. Once the monitoring AP sees these
frames, it will spoof the probe-response and association response frames, and manipulates the content of the
frames to confuse the client.
A station is determined to be in the Tarpit when we see it sending data frames in the fake channel. With some
clients, the station remains in tarpit state until the user manually disables and re-enables the wireless interface.