Specifications

5-40 WS2000 Wireless Switch System Reference Guide
WIDS also keep track of anomalies. An anomaly is defined as an event which is different from the general
occurrences on a WS2000. The following anomalies are tracked:
• null-dst - NULL destination
• same-src-dst - Same source and destination address
• mcast-src - Source MAC is multicast
• weak-wep-iv - Weak WEP
• tkip-cntr-meas - TKIP counter measures
• invalid-frame-len - Invalid frame length
5.11.1 WIDS Configuration
The WIDS parameters for violations and anomalies can be configured from the Configuration tab of the
WIDS screen. The tab is enabled when the Enable WIDS check box is selected.
To configure WIDS:
1. Enter a time value in seconds for the Detect Window. WIPS checks for violations and anomalies every
detect window value. For example, if the value is 30 seconds, WIPS checks for violations and anomalies
every 30 seconds.
5.11.1.1 Excessive Violation Parameters
Use the Excessive Violation Parameters section to set violation parameters. Violation parameters
threshold values can be set for MUs, Radio, and Switch.
To set the Excessive Violation Parameter value:
1. Click on the violation that you want to monitor.
2. If you would like to monitor the MU for a violation, click under the MU Threshold column for that violation.
The column becomes editable. Enter a suitable value for the threshold. You can similarly set the
thresholds for the Radio as well as the Switch for the violation.
3. Use the Time to Filter column to set the time duration during which any packets received from the MU
will be filtered out. For example, if this value is set to 135 seconds, the MU is filtered out for 135 seconds.
The Radio Threshold and Switch Threshold columns enables you to set up threshold values upon
reaching which a SNMP trap is generated.
5.11.1.2 Anomaly Violation Parameters
Use the Anomaly Violation Parameters section to set the parameters for Anomalies. When enabled, the MU
is filtered out for the duration specified in the Time to Filter column.
1. Enable or disable Anomaly Violation detection by selecting the MU Threshold check box.
2. Use the Time to Filter column to set the time duration during which any packets received from the MU
will be filtered out. For example, if this value is set to 135 seconds, the MU is filtered out for 135 seconds.
3. Click the Apply button to save any changes made on this screen. Navigating away from the current
screen without clicking the Apply button results in all changes to this screen being lost.