| OID symbolic | OID numeric | Type | Access | Description |
|---|
| ciscoDot11WidsMIB | 1.3.6.1.4.1.9.9.456 | | | This MIB is intended to be implemented on the
following IOS based network entities for the purpose
of providing network management stations information
about the various attempts to compromise the security
in the 802.11-based wireless networks.
(i) 802.11 Access Points that accept wireless client
associations.
The MIB reports the information about the following
attacks that can happen either at the initial
authentication phase or during normal data
communication between the client and the AP.
EAPOL flooding - This is an attempt made by an
invalid 802.11 client to send too many EAPOL-Start
messages and bring the authentication services
on the Authenticator, typically the AP, down.
BlackListing - This is the process of marking
a client as invalid when its authentication
attempts fail. The client is put in a list
when its authentication attempt fails for the
first time. If the number of consecutive
failed authentication attempts reach a threshold,
any subsequent authentication requests made by
the client will be rejected from that point for
a configurable period of time.
Protection Failures - These kind of failures
happen when the attacker injects invalid packets
onto the wireless network thereby corrupting the
802.11 data traffic between an AP and its
associated wireless clients.
The administrator, through the NMS, can configure
the thresholds on the AP using this MIB to enable
the AP detect the EAPOL flood attacks and provide
related statistics to the NMS.
To detect protection failures, the AP provides the
relevant statistics about the protection errors in
the form of MIB objects, which are compared against
the thresholds configured on the NMS and appropriate
events are raised by the NMS, if thresholds are
found to be exceeded.
The hierarchy of the AP and MNs is as follows.
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
+ + + + + + + +
+ AP + + AP + + AP + + AP +
+ + + + + + + +
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
.. . . .
.. . . .
. . . . .
. . . . .
. . . . .
. . . . .
\/ \/ \/ \/ \/
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
+ + + + + + + + + +
+ MN + + MN + + MN + + MN + + MN +
+ + + + + + + + + +
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
The wireless connections are represented as dotted
lines in the above diagram.
GLOSSARY
Access Point ( AP )
An entity that contains an 802.11 medium access
control ( MAC ) and physical layer ( PHY ) interface
and provides access to the distribution services via
the wireless medium for associated clients.
Mobile Node ( MN )
A roaming 802.11 wireless device in a wireless
network associated with an access point.
Service Set Identifier (SSID)
The Radio Service Set ID that is used by the mobile
wireless clients for identification during the
association with the APs.
Temporal Key Integrity Protocol (TKIP)
A security protocol defined to enhance the limitations
of WEP. Message Integrity Check and per-packet keying
on all WEP-encrypted frames are two significant
enhancements provided by TKIP to WEP.
Counter mode with CBC-MAC Protocol (CCMP)
A security protocol that uses the counter mode in
conjunction with cipher block chaining. This method
divides the data into blocks, encrypts the first
block, XORs the results with the second block,
encrypts the result, XORs the result with the next
block and continues till all the blocks are
processed. This way, this protocol derives a
64-bit MIC which is appended to the plaintext data
which is again encrypted using the counter mode.
Message Integrity Check (MIC)
The Message Integrity Check is an improvement over the
Integrity Check Function (ICV) of the 802.11 standard.
MIC adds two new fields to the wireless frames - a
sequence number field for detecting out-of-order
frames and a MIC field to provide a frame integrity
check to overcome the mathematical shortcomings of
the ICV.
802.1x
The IEEE ratified standard for enforcing port based
access control. This was originally intended for
use on wired LANs and later extended for use in
802.11 WLAN environments. This defines an
architecture with three main parts - a supplicant
(Ex. an 802.11 wireless client), an authenticator
(the AP) and an authentication server(a Radius
server). The authenticator passes messages back
and forth between the supplicant and the
authentication server to enable the supplicant
get authenticated to the network.
Extensible Authentication Protocol Over LAN (EAPOL)
This is an encapsulation method defined by 802.1x
passing EAP packets over Ethernet frames. |
| ciscoDot11WidsMIBNotifs | 1.3.6.1.4.1.9.9.456.0 | | | |
| ciscoDot11WidsMIBObjects | 1.3.6.1.4.1.9.9.456.1 | | | |
| ciscoDot11WidsAuthFailures | 1.3.6.1.4.1.9.9.456.1.1 | | | |
| T/F cDot11WidsFloodDetectEnable | 1.3.6.1.4.1.9.9.456.1.1.1 | TruthValue | read-write | This object is used to enable or disable the WIDS
flood detection feature.
Set this MIB object to 'true' to enable the
flood detection and 'false' to disable it.
Note that the values configured through
cDot11WidsFloodThreshold and
cDot11WidsEapolFloodInterval take effect only if
flood detection is enabled through this MIB
object. |
| U32 cDot11WidsEapolFloodThreshold | 1.3.6.1.4.1.9.9.456.1.1.2 | Unsigned32 | read-write | This object specifies the maximum number of
authentication attempts allowed for all the clients
taken together in the interval specified by
cDot11WidsEapolFloodInterval. The attempts include
both the successful as well as failed attempts. |
| U32 cDot11WidsEapolFloodInterval | 1.3.6.1.4.1.9.9.456.1.1.3 | Unsigned32 | read-write | This object specifies the time duration for
which the client authentication attempts have to
be monitored for detecting the flood attack. |
| U32 cDot11WidsBlackListThreshold | 1.3.6.1.4.1.9.9.456.1.1.4 | Unsigned32 | read-write | This object configures the maximum threshold on
the number of unsuccessful authentication attempts,
that can be made by a particular client. Once the
threshold is reached, the client is retained in the
list for a period of time equal to the value
configured through cDot11WidsBlackListDuration,
during which its attempts to get authenticated
are blocked. |
| U32 cDot11WidsBlackListDuration | 1.3.6.1.4.1.9.9.456.1.1.5 | Unsigned32 | read-write | This object indicates the time duration for which a
particular client has to be kept in the black list
after the number of unsuccessful attempts reach the
threshold given by cDot11WidsBlackListThreshold. |
| I32 cDot11WidsFloodMaxEntriesPerIntf | 1.3.6.1.4.1.9.9.456.1.1.6 | Integer32 | read-write | This object indicates the maximum number of entries
that can be held for a particular 802.11 radio
interface identified by ifIndex. |
| cDot11WidsEapolFloodTable | 1.3.6.1.4.1.9.9.456.1.1.7 | | not-accessible | This table gives the statistics on the EAPOL flood
attacks observed at this radio interface.
An entry in this table is created by the agent when
this 802.11 station detects an EAPOL flood attack.
All the columns in the entries except the
cDot11WidsEapolFloodStopTime are populated when
the attack is observed first. The object
cDot11WidsEapolFloodStopTime is populated when no
flood conditions are observed following the initial
observation at the time indicated by
cDot11WidsEapolFloodStartTime.
This can be illustrated by the following example.
Assume that the monitoring interval is configured
to 1 minute through the
cDot11WidsEapolFloodInterval object and the number
of attempts is set to 5.
At the end of the first minute after this
configuration is made, client c1 is found to
have made 4 attempts and another client c2 have
made 3. Hence, in total, the attempt count
exceeds 7 and the agent adds a new row to this
table. The cDot11WidsFloodStopTime carries a
value of 0 at this point in the newly added row.
The MIB object cDot11WidsEapolFloodClientMac
at this point holds the MAC address of c1
and cDot11WidsEapolFloodClientCount holds the
value of 4.
At the end of the second interval, assume that
the clients are found to have made only 4
attempts in total with c1 and c2 making 3 and 1
attempt(s) respectively. Now the total count
is not found to exceed the threshold. Hence
the flood is observed to be stopped. The
object cDot11WidsEapolFloodStopTime is now
populated with this time at which the flood is
observed to be stopped. The MIB object
cDot11WidsEapolFloodClientMac at this point
holds c1's MAC address and
cDot11WidsEapolFloodClientCount would hold a
value of 7. If the count is found to exceed in
the next interval, it will be treated as a
beginning of a new flood event and hence a new
entry will be created for the same.
Assume the case where, at the end of the second
interval, the total count continues at the
rate above the threshold, with c1 making 5 and
c2 making 2 attempts respectively. Since the
flood is not observed to be stopped, the
object cDot11WidsFloodStopTime continues to
hold a value of zero.
The agent at anytime will retain only the most
recent and maximum number of entries, as given
by cDot11WidsFloodMaxEntriesPerIntf, for a
particular value of ifIndex. The older entries
are purged automatically when the number of
entries for a particular ifIndex reaches its
maximum.
This table has a expansion dependent relationship
with ifTable defined in IF-MIB. There exists a
row in this table corresponding to the row for each
interface of iftype ieee80211(71) found in ifTable.
cDot11WidsEapolFloodIndex acts as the
expansion index. |
| cDot11WidsEapolFloodEntry | 1.3.6.1.4.1.9.9.456.1.1.7.1 | | not-accessible | An entry holds the statistics about one instance of
EAPOL flood attack observed at this particular
radio interface. |
| U32 cDot11WidsEapolFloodIndex | 1.3.6.1.4.1.9.9.456.1.1.7.1.1 | Unsigned32 | not-accessible | This object identifies the set of information about
one instance of an EAPOL flood event observed at
this radio interface between the start and stop
times indicated by cDot11WidsEapolFloodStartTime
and cDot11WidsEapolFloodStopTime. |
| MAC cDot11WidsEapolFloodClientMac | 1.3.6.1.4.1.9.9.456.1.1.7.1.2 | MacAddress | read-only | This object identifies the MAC address of the
wireless client that has made the maximum
number of authentication attempts in the
duration specified by the
cDot11WidsEapolFloodInterval object.
At the end of each interval time indicated by
cDot11WidsFloodInterval, the 802.11 station
checks whether the total count of the number of
authentication attempts made by all the clients
exceed the threshold configured through the
object cDot11WidsEapolFloodThreshold. If yes,
then the agent populates this MIB object
with the MAC of the wireless client that has
made the maximum number of authentication
attempts in that interval.
When the flood event is observed to be stopped,
as indicated by a non-zero value for the
cDot11WidsEapolFloodStopTime object,
this object indicates the MAC of the wireless
client that has made the maximum number of
attempts for the entire duration of the flood
observed between the times indicated by the
objects cDot11WidsEapolFloodStartTime and
cDot11WidsEapolFloodStopTime respectively. |
| U32 cDot11WidsEapolFloodClientCount | 1.3.6.1.4.1.9.9.456.1.1.7.1.3 | Unsigned32 | read-only | This object provides the count associated with
the client with largest number of attempts in
the last interval.
When the flood event is observed to be stopped,
as indicated by a non-zero value for the
cDot11WidsEapolFloodStopTime object, this
object gives the count associated with the
client with the largest number of attempts,
for the entire duration of the flood observed
between the times indicated by the objects
cDot11WidsEapolFloodStartTime and
cDot11WidsEapolFloodStopTime respectively. |
| TIM cDot11WidsEapolFloodStartTime | 1.3.6.1.4.1.9.9.456.1.1.7.1.4 | TimeStamp | read-only | This object indicates the time at which the
EAPOL flood event identified by one entry of
this table was observed first at this radio
interface. |
| TIM cDot11WidsEapolFloodStopTime | 1.3.6.1.4.1.9.9.456.1.1.7.1.5 | TimeStamp | read-only | This object indicates the time at which the
the EAPOL flood event observed first at the
time indicated by cDot11WidsEapolFloodStartTime
has stopped.
If this 802.11 station finds that the flood
conditions observed in the one or more prior
intervals has ceased, it marks the flood
event as stopped at the time indicated by
this object. That the flood has ceased is
indicated by the number of authentication
attempts dropping below the value specified by
the cDot11WidsEapolFloodThreshold object.
A value of 0 for this object indicates that
the number of authentication attempts continue
to exceed the value specified by the
cDot11WidsEapolFloodThreshold object. |
| C32 cDot11WidsEapolFloodTotalCountEx | 1.3.6.1.4.1.9.9.456.1.1.7.1.6 | Counter32 | read-only | This object gives the accumulated count of the
number of authentication attempts made by all the
clients at the time of query. |
| cDot11WidsBlackListTable | 1.3.6.1.4.1.9.9.456.1.1.8 | | not-accessible | This table gives the information about the
802.11 wireless clients that have been blacklisted
while attempting to get authenticated with this
802.11 station at this radio interface.
An entry is added to this table when the number
of consecutive failed authentication attempts
made by a client equals the value configured
through cDot11WidsBlackListThreshold. The
client will then be blocked from getting
authenticated for a time period equal to the
value configured through
cDot11WidsBlackListDuration. After this time
elapses, the client is taken off from the list
and the agent automatically removes the entry
corresponding to that client from this table.
This table has a expansion dependent relationship on
the ifTable. For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71). cDot11BlackListIndex acts as the
expansion index. |
| cDot11WidsBlackListEntry | 1.3.6.1.4.1.9.9.456.1.1.8.1 | | not-accessible | Each entry holds the information about one
802.11 wireless client that has been blacklisted
when attempting to get authenticated with
this 802.11 station at this radio interface. |
| MAC cDot11WidsBlackListClientMac | 1.3.6.1.4.1.9.9.456.1.1.8.1.1 | MacAddress | not-accessible | This object indicates the Mac Address of the
blacklisted client. |
| C32 cDot11WidsBlackListAttemptCount | 1.3.6.1.4.1.9.9.456.1.1.8.1.2 | Counter32 | read-only | This object counts the total number of attempts
made by the client identified by
cDot11WidsBlackListClientMac to get authenticated
with the 802.11 station through this radio
interface. |
| TIM cDot11WidsBlackListTime | 1.3.6.1.4.1.9.9.456.1.1.8.1.3 | TimeStamp | read-only | This object indicates the time at which the client
was blacklisted after failing in its attempt to get
authenticated with this 802.11 station at this radio
interface. |
| ciscoDot11WidsProtectFailures | 1.3.6.1.4.1.9.9.456.1.2 | | | |
| cDot11WidsProtectFailClientTable | 1.3.6.1.4.1.9.9.456.1.2.1 | | not-accessible | This table gives the statistics on the various
protection failures occurred during the data
communication of this 802.11 station with a
particular client currently associated at this
dot11 interface.
Note that the agent populates this table with an
entry for an associated client if and only if
at least one of the error statistics, as reported
by the counter-type objects of this table, has a
non-zero value.
This table has a expansion dependent relationship on
the ifTable. For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71). cDot11WidsSsid and
cDot11WidsClientMacAddress act as the
expansion indices. |
| cDot11WidsProtectFailClientEntry | 1.3.6.1.4.1.9.9.456.1.2.1.1 | | not-accessible | Each entry holds the information about the
protection failures observed at this radio
interface when this 802.11 station communicates with
its associated client identified by
cDot11WidsClientMacAddress at the interface
identified by ifIndex. The clients are grouped
according to the SSIDs they use for their
association with the dot11 interface. |
| OCT cDot11WidsSsid | 1.3.6.1.4.1.9.9.456.1.2.1.1.1 | OCTET STRING | not-accessible | This object specifies one of the SSIDs of this
radio interface using which the client has
associated with the 802.11 station. |
| MAC cDot11WidsClientMacAddress | 1.3.6.1.4.1.9.9.456.1.2.1.1.2 | MacAddress | not-accessible | This object identifies the MAC address of the
associated client to which this set of
statistics are applicable. |
| OCT cDot11WidsSelPairWiseCipher | 1.3.6.1.4.1.9.9.456.1.2.1.1.3 | OCTET STRING | read-only | This object identifies the pairwise cipher used by
the client identified by cDot11WidsClientMacAddress
during its association with this 802.11 station
at the interface identified by ifIndex. |
| C32 cDot11WidsTkipIcvErrors | 1.3.6.1.4.1.9.9.456.1.2.1.1.4 | Counter32 | read-only | This object counts the total number of TKIP ICV
Errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the
radio interface identified by ifIndex. |
| C32 cDot11WidsTkipLocalMicFailures | 1.3.6.1.4.1.9.9.456.1.2.1.1.5 | Counter32 | read-only | This object counts the total number of TKIP local
MIC failures observed in the data communication
between this 802.11 station and the client
indicated by cDot11WidsClientMacAddress since
the client's association with this 802.11 station
at the radio interface identified by ifIndex. |
| C32 cDot11WidsTkipRemoteMicFailures | 1.3.6.1.4.1.9.9.456.1.2.1.1.6 | Counter32 | read-only | This object counts the total number of TKIP remote
MIC failures observed in the data communication
between this 802.11 station and the client
indicated by cDot11WidsClientMacAddress since the
client's association with this 802.11 station
at the radio interface identified by ifIndex. |
| C32 cDot11WidsCcmpReplays | 1.3.6.1.4.1.9.9.456.1.2.1.1.7 | Counter32 | read-only | This object counts the total number of CCMP replay
failures observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex. |
| C32 cDot11WidsCcmpDecryptErrors | 1.3.6.1.4.1.9.9.456.1.2.1.1.8 | Counter32 | read-only | This object counts the total number of CCMP
decryption failures observed in the data
communication between this 802.11 station and
the client indicated by cDot11WidsClientMacAddress
since the client's association with this
802.11 station at the radio interface identified
by ifIndex. |
| C32 cDot11WidsTkipReplays | 1.3.6.1.4.1.9.9.456.1.2.1.1.9 | Counter32 | read-only | This object counts the total number of TKIP
replay failures observed in the data
communication between this 802.11 station and the
client indicated by cDot11WidsClientMacAddress
since the client's association with this
802.11 station at the radio interface identified
by ifIndex. |
| C32 cDot11WidsWepReplays | 1.3.6.1.4.1.9.9.456.1.2.1.1.10 | Counter32 | read-only | This object counts the total number of WEP Replay
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex. |
| C32 cDot11WidsWepIcvErrors | 1.3.6.1.4.1.9.9.456.1.2.1.1.11 | Counter32 | read-only | This object counts the total number of WEP ICV
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex. |
| C32 cDot11WidsCkipReplays | 1.3.6.1.4.1.9.9.456.1.2.1.1.12 | Counter32 | read-only | This object counts the total number of CKIP replay
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex. |
| C32 cDot11WidsCkipCmicErrors | 1.3.6.1.4.1.9.9.456.1.2.1.1.13 | Counter32 | read-only | This object counts the total number of CKIP-CMIC
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the
radio interface identified by ifIndex. |
| ciscoDot11WidsMIBConform | 1.3.6.1.4.1.9.9.456.2 | | | |
| ciscoDot11WidsMIBCompliances | 1.3.6.1.4.1.9.9.456.2.1 | | | |
| ciscoDot11WidsMIBCompliance | 1.3.6.1.4.1.9.9.456.2.1.1 | | | The compliance statement for the SNMP entities that
implement the ciscoDot11WidsMIB module. |
| ciscoDot11WidsMIBGroups | 1.3.6.1.4.1.9.9.456.2.2 | | | |
| ciscoDot11WidsAuthFailGroup | 1.3.6.1.4.1.9.9.456.2.2.1 | | | This collection of objects provide information about
configuration needed on the 802.11 station to detect
the EAPOL flood attacks and black-list clients,
the general statistics about the detected flood
flood attacks and the information about the
blacklisted clients. |
| ciscoDot11WidsProtectFailGroup | 1.3.6.1.4.1.9.9.456.2.2.2 | | | This collection of objects provide information about
the various protection failures observed during the
associated clients' data communications with this
802.11 station. |
