ids dos-profile

Name of the IDS DoS profile.

Range: 1-63 characters

Default: “default”

Time, in seconds, during which the AP count is over the threshold (AP flood).

Range: 0-36000 seconds

Default: 3600 seconds

After an alarm has been triggered by an AP flood, the time, in seconds, that must elapse before an identical alarm may be triggered.

Range: 60-360000 seconds

Default: 900 seconds

Threshold for the number of spurious APs in the system.

Range: 0-100,000

Default: 50

Rate threshold for associate request frames.

Rate threshold for authenticate frames.

Time to wait, in seconds, after detecting an attempt to reset the receive window using a forged block ACK add.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a ChopChop attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Quiet time (when to stop reporting intolerant STAs if they have not been detected), in seconds, for detection of 802.11n 40 MHz intolerance setting.

Range: 60-360000 seconds

Default: 900 seconds

Number of consecutive seconds over which the client count is more than the threshold.

Range: 0-36000 seconds

Default: 3 seconds

Time to wait, in seconds, after detecting a client flood before continuing the check.

Range: 60-360000 seconds

Default: 900 seconds

Threshold for the number of spurious clients in the system.

Range: 0-100000

Default: 150

Copies data from another IDS Denial Of Service Profile.

Time to wait, in seconds, after detecting a CTS rate anomaly after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Number of CTS control packets over the time interval that constitutes an anomaly.

Range: 0-100000

Default: 5000

Time interval, in seconds, over which the packet count should be checked.

Range: 1-120 seconds

Default: 5 seconds

Rate threshold for deauthenticate frames.

Enables or disables detection of AP flood attacks.

Default: disabled

Enables or disables detection of attempts to reset traffic receive windows using forged Block ACK Add messages.

Default: enabled

Enables or disables detection of ChopChop attacks.

Default: disabled

Enables or disables detection of client flood attacks.

Default: disabled

Enables or disables detection of CTS rate anomalies.

Default: disabled

In a station disconnection attack, an attacker spoofs the MAC address of either an active client or an active AP. The attacker then sends deauthenticate frames to the target device, causing it to lose its active association.

Use this command to enable the detection of disconnect station attack.

Default: enabled

Enables or disables detection of the EAP handshake rate anomaly.

Default: disabled

Enables or disables detection of FATA-Jack attacks.

Default: enabled

Enables or disables detection of ghost tunnel client attacks.

Default: disabled

Enables or disables detection of ghost tunnel server attacks.

Default: disabled

Enables or disables detection of 802.11n 40 MHz intolerance setting, which controls whether stations and APs advertising 40 MHz intolerance will be reported.

Default: disabled

Enables or disables detection of invalid address combinations.

Default: disabled

Enables or disables detection of malformed association requests.

Default: disabled

Enables or disables detection of malformed authentication frames.

Default: disabled

Enables or disables detection of malformed HT IE.

Default: disabled

Enables or disables detection of unusually large durations in frames.

Default: enabled

Enables or disables detection of Omerta attacks.

Default: enabled

Enables or disables detection of overflow EAPOL key requests.

Default: disabled

Enables or disables detection of overflow IEs.

Default: disabled

Enables or disables detection of Power Save DoS attacks.

Default: enabled

Enables or disables detection of rate anomalies.

Default: disabled

Enables or disables detection of RTS rate anomalies.

Default: disabled

Enables or disables detection of TKIP replay attacks.

Default: disabled

Enables or disables detection of WPA FT attacks.

Default: disabled

Rate threshold for disassociate frames.

Number of deauthentication or disassociation frames seen in an interval of 10 seconds.

Range: 1-50

Default: 8

The number of successful Association Response or Reassociation response frames seen in an interval of 10 seconds.

Range: 1-30

Default: 5

After a station disconnection attack is detected, the time, in seconds, that must elapse before the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

After an EAP rate anomaly alarm has been triggered, the time, in seconds, that must elapse before the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Number of EAP handshakes that must be received within the EAP rate time interval to trigger an alarm.

Range: 0-100000

Default: 60

Time, in seconds, during which the configured number of EAP handshakes must be received to trigger an alarm.

Range: 1-120 seconds

Default: 3 seconds

Time to wait, in seconds, after detecting a FATA-Jack attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time interval, in seconds, over which the packet count is checked. Default is 60 seconds. Maximum is 600 seconds.

Number of probe request management packets for a fake AP over the time interval that constitutes a ghost tunnel attack. Default is 10. Maximum is 100000.

Time to wait, in seconds, after detecting a ghost tunnel attack after which the check is resumed. Default is 900 seconds. Minimum is 60 seconds.

Time interval, in seconds, over which the packet count is checked. Default is 60 seconds. Maximum is 600 seconds.

Number of beacon management packets for a fake AP over the time interval that constitutes a ghost tunnel attack. Default is 200. Maximum is 10000.

Time to wait, in seconds, after detecting a ghost tunnel attack after which the check is resumed. Default is 900 seconds. Minimum is 60 seconds.

Time to wait, in seconds, after detecting an invalid address combination after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a malformed association request after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a malformed authentication frame after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a malformed HT IE after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a large duration for a frame after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Negates any configured parameter.

Time to wait, in seconds, after detecting an Omerta attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

The Disassociation packets received by a station as a percentage of the number of data packets sent, in an interval of 10 seconds.

Range: 1-100

Default: 10%

Time to wait, in seconds, after detecting a overflow EAPOL key request after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a overflow IE after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

The minimum number of Power Management OFF packets that are required to be seen from a station, in intervals of 10 second, in order for the Power Save DoS check to be done.

Range: 1-1000

Default: 120

Time to wait, in seconds, after detecting a Power Save DoS attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

The Power Management ON packets sent by a station as a percentage of the Power Management OFF packets sent, in intervals of 10 second, which will trigger this event.

Range: 1- 100%

Default: 80%

Rate threshold for probe request frames.

Rate threshold for probe response frames.

Time to wait, in seconds, after detecting an RTS rate anomaly after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Number of RTS control packets over the time interval that constitutes an anomaly.

Range: 0-100000

Default: 5000

Time interval, in seconds, over which the packet count should be checked.

Range: 1-120 seconds

Default: 5 seconds

Time to wait, in seconds, after detecting a TKIP replay attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Time to wait, in seconds, after detecting a WPA FT attack after which the check can be resumed.

Range: 60-360000 seconds

Default: 900 seconds

Number of reassociation management packets for a particular client over the time interval that constitutes a WPA FT attack.

Range: 0-100000

Default: 45