User manual

Overview
14-16
14.1.14 ids
Wireless Configuration Commands
Use this command to configure Intrusion Detection System settings.
Syntax
ids(anomaly-detection|detect-window|ex-ops)
ids anomaly-detection(all|invalid-frame-length|multicast-source|
null-destination|same-source-destination|tkip-countermeasures|weak-wep-iv)
(enable|filter-ageout)
ids detect-window<5-300>
ids ex-ops(80211-replay-fails|all|association-requests|
authentication-fails|crypto-replay-fails|decryption-fails|
disassociations|eap-starts|probe-requests|unassoc-frames)
(filter-ageout
<0-86400>|threshold(mu|radio|switch)<0-9999>)
Parameters
anomaly-detection Configures parameters related to the detection of anomalous frames on the
RF network.
• all – Enables anomalous frames.
• invalid-frame-length – Invalid frame lengths.
• multicast-source – Broadcast or multicast source.
• null-destination – All zero's addess.
• same-source-destination – Identical source and destination addresses.
• tkip-countermeasures – Filters mobile units that cause tkip
countermeasures.
• weak-wep-iv – Uses weak wep sequence numbers.
• enable – Enables monitoring and filtering.
• filter-ageout – Sets the number of seconds mobile units must be
filtered.
detect-window<5-300> Sets the number of seconds information must be collected before analysis.
All the thresholds are a function of this window size.