User's Manual

Wireless Array
Configuring the Wireless Array 339
without a controlling Access Point, also called an Independent Basic
Service Set — IBSS).
• ESS/Infrastructure only — only consider auto blocking rogue APs if
they are in infrastructure mode rather than ad hoc mode.
6. Auto Block Whitelist: Use this list to specify channels to be excluded
from automatic blocking. If you have enabled Auto Block, it will not be
applied to rogues detected on the whitelisted channels. Use the Add
Channel drop-down to add entries to the Channels list, one at a time.
You can delete entries from the list by selecting them from the Remove
Channel drop-down list.
DoS Attack Detection Settings
7. Attack/Event:
The types of DoS attack that you may detect are described
in the Type of Attack Table on page 335. Detection of each attack type
may be separately enabled or disabled. For each attack, a default
Threshold and Period (seconds) are specified. If the number of
occurrences of the type of packet being detected exceeds the threshold in
the specified number of seconds, then the Array declares that an attack
has been detected. You may modify the Threshold and Period.
For the Flood attack settings, you also have a choice of Auto or Manual.
• Manual mode — threshold and period settings are used to detect a
flood. Packets received are simply counted for the specified time
period and compared against the flood threshold. The default for all
of the floods is Manual mode.
• Auto mode — the Array analyzes current traffic for packets of a given
type versus traffic over the past hour to determine whether a packet
flood should be detected. In this mode, threshold and period settings
are ignored. This mode is useful for floods like beacon or probe
floods, where the numbers of such packets detected in the air can
vary greatly from installation to installation.