Motorola Wing 5 Manual

CHAPTER 10 ADVANCED-WIPS-POLICY
This chapter summarizes the advanced WIPS policy commands within the CLI structure.
Use the (config) instance to configure advance WIPS policy commands. To navigate to the advanced WIPS policy instance, 
use the following commands:
RFSSwitch(config)#advanced-wips-policy 
rfs7000-37FABE(config)#advanced-wips-policy test
rfs7000-37FABE(config-advanced-wips-policy-test)#?
Advanced WIPS policy Mode commands:
  event               Configure event detection
  no...

10 - 2 WiNG CLI Reference Guide
10.1 advanced-wips-policy
Table 10.1 summarizes advanced WIPS policy commands
Table 10.1advanced-wips-policy commands
Command Description Reference
eventConfigures eventspage 10-3
noNegates a command or sets its defaultpage 10-10
server-listen-portSets a local WIPS server’s listening portpage 10-13
terminateAdds a device to a list of terminated devicespage 10-14
useDefines the settings used with the advanced WIPS policypage 10-15
clrscrClears the display screenpage 5-3...

ADVANCED-WIPS-POLICY 10 - 3
10.1.1 event
advanced-wips-policy
Configures the detection of anomalous frames in a RF network 
Supported in the following platforms:
 AP300
 AP621
 AP650
 AP6511
 AP6521
 AP6532
 AP71XX
 RFS4000
 RFS6000
 RFS7000
 NX9000
 NX9500
Syntax
event [accidental-association|all|crackable-wep-iv-used|dos-cts-flood|
dos-deauthentication-detection|dos-disassociation-detection|
dos-eap-failure-spoof|dos-eapol-logoff-storm|dos-rts-flood|...

10 - 4 WiNG CLI Reference Guide
event dos-eapol-logoff-storm threshold [eapol-start-frames-ap |eapol-start-
frames-mu 
event dos-eapol-logoff-storm trigger-against sanctioned
event probe-response-flood threshold probe-rsp-frames-count 
event probe-response-flood trigger-against sanctioned
event rogue-ap-detection mitigation-enable
event rogue-ap-detection trigger-against (neighboring,sanctioned,unsanctioned)
event unauthorized-bridge mitigation-enable
event unauthorized-bridge trigger-against...

ADVANCED-WIPS-POLICY 10 - 5
dos-eap-failure-spoof This event occurs when a Dos EAP failure spoofing attack is detected
With this attack, the attacker generates a large number of EAP-failure packets 
forcing the AP to disassociate with its legitimate wireless clients.
essid-jack-attack-detected This event occurs when an essid-jack attack is detected
Essid-jack is a tool in the AirJack suite that sends a disassociate frame to a target 
client to force it to reassociate it to the network to find the SSID....

10 - 6 WiNG CLI Reference Guide
• event [dos-rts-flood|invalid-channel-advertized|invalid-management-frame] trigger-
against (neighboring,sanctioned,unsanctioned)
multicast-igrp-routers-detection This event occurs when a sanctioned device detects multicast Interior Gateway 
Routing Protocol (IGRP) packets
multicast-ospf-all-routers-
detectionThis event occurs when a sanctioned device detects multicast Open Shortest Path 
First (OSPF) packets
multicast-ospf-designated-
routers-detectionThis event occurs...

ADVANCED-WIPS-POLICY 10 - 7
• event dos-cts-flood threshold [cts-frames-ratio |mu-rx-cts-frame ]
• event dos-cts-flood trigger-against (neighboring,sanctioned,unsanctioned)
• event dos-eapol-logoff-storm threshold [eapol-start-frames-ap |eapol-
start-frames-mu 
invalid-management-frame This event occurs when an invalid management frame is detected in the controller 
managed network
trigger-against 
(neighboring,sanctioned,unsanct
ioned)Sets the trigger condition. The following conditions are available:...

10 - 8 WiNG CLI Reference Guide
• event dos-eapol-logoff-storm trigger-against sanctioned
• event probe-response-flood threshold probe-rsp-frames-count 
• event probe-response-flood trigger-against sanctioned
• event rogue-ap-detection mitigation-enable
• event rogue-ap-detection trigger-against (neighboring,sanctioned,unsanctioned)
• event unauthorized-bridge mitigation-enable
dos-eapol-logoff-storm This event occurs when a large number of EAPOL logoff frames are detected in the 
network
trigger-against...

ADVANCED-WIPS-POLICY 10 - 9
• event unauthorized-bridge trigger-against (neighboring,unsanctioned)
Example
rfs7000-37FABE(config-advanced-wips-policy-test)#event dos-cts-flood threshold cts-
frames-ratio 8
rfs7000-37FABE(config-advanced-wips-policy-test)#event dos-eapol-logoff-storm 
threshold eapol-start-frames-mu 99
rfs7000-37FABE(config-advanced-wips-policy-test)#event probe-response-flood 
threshold probe-rsp-frames-count 8
rfs7000-37FABE(config-advanced-wips-policy-test)#event...

10 - 10 WiNG CLI Reference Guide
10.1.2 no
advanced-wips-policy
Negates a command or sets its default value
Supported in the following platforms:
 AP300
 AP621
 AP650
 AP6511
 AP6521
 AP6532
 AP71XX
 RFS4000
 RFS6000
 RFS7000
 NX9000
 NX9500
Syntax
no [event|server-listen-port|terminate|use]
no event [accidental-association|crackable-wep-iv-used|dos-cts-flood|
dos-deauthentication-detection|dos-disassociation-detection|
dos-eap-failure-spoof|dos-eapol-logoff-storm|dos-rts-flood|...