CISCO-WDS-IDS-MIB

All MIBs › CISCO-WDS-IDS-MIB

Organization: Cisco Systems Inc.

Last Updated: 2004-10-17

Category: Vendor: Cisco Devices, Wireless and WLAN

Description: Manages Cisco Wireless Domain Services intrusion detection, monitoring rogue APs and wireless attacks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-WDS-IDS-MIB?

CISCO-WDS-IDS-MIB is a Cisco MIB implemented on IOS-based network entities providing Wireless Domain Services (an access point, switch, or other IOS device configured as a WDS), giving management stations visibility into attempts to compromise 802.11 wireless network security. It exposes configuration limits for how many MAC addresses and per-MAC entries it tracks, plus a MAC-spoofing detection table recording each detected client's MAC address, an internal index, the associated wireless client/user identifier, and the time spoofing was detected. Its monitoring focus is security-fault oriented rather than general hardware health -- it lets an operator see, in near real time, which client stations are suspected of MAC address spoofing (a common wireless intrusion technique) and when each detection occurred. It is deployed as part of Cisco's broader Wireless Domain Services/IOS wireless security feature set, complementing standard 802.11 and Cisco wireless MIBs rather than standing alone. It is deployed on Cisco IOS-based access points, wireless-capable switches, or WDS-designated devices providing centralized wireless intrusion detection across an 802.11 network. Network engineers evaluating or troubleshooting this functionality can download the CISCO-WDS-IDS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-WDS-IDS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco IOS-based wireless access point or WDS-designated switch

Monitoring Examples

Polling ciscoWdsIdsMacSpoofTable/ciscoWdsIdsMacSpoofEntry reveals each row's ciscoWdsIdsMacSpoofStaMacAddress, ciscoWdsIdsMacSpoofClient, and ciscoWdsIdsMacSpoofDetectTime, letting a security operator identify exactly which station MAC was detected spoofing and when, and correlate it against known-good client inventories. ciscoWdsIdsMaxMacAddresses and ciscoWdsIdsMaxEntriesPerMac define the detection table's capacity, which an operator would monitor to ensure the table isn't silently dropping new detections once full. A sudden spike in new ciscoWdsIdsMacSpoofTable entries within a short time window would indicate an active spoofing/rogue-client attack against the wireless network.

What Can Be Monitored

detected MAC-spoofing events
spoofed client MAC addresses
detection timestamps
MAC address tracking table capacity

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TimeStamp

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoWdsIdsMIB	1.3.6.1.4.1.9.9.457			This MIB is intended to be implemented on all IOS based network entities that provide Wireless Domain Services, for the purpose of providing network management stations information about the various attempts to compromise the security in the 802.11-based wireless networks. Entities that can be configured to provide Wireless Domain Services could be an 802.11 Access Point, a Switch or any other IOS network device, that allows the WDS configuration. The MIB reports the information about the MAC spoofing attempts made by wireless clients to compromise the security of the network. MAC Spoofing is detected by the WDS when clients attempt to authenticate with the WDS using the MAC address of another client while roaming from one AP to another. Upon detecting this, the WDS provides the information about the client and the username to the NMS as MIB objects. The hierarchy of the WDS, AP and MNs is as follows. +=====+ +=====+ +=====+ \| \| \| \| \| \| \| WDS \| \| WDS \| \| WDS \| \| \| \| \| \| \| +=====+ +=====+ +=====+ / \ \ \ / \ \ \ / \ \ \ / \ \ \ / \ \ \ \/ \/ \/ \/ +~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+ + + + + + + + + + AP + + AP + + AP + + AP + + + + + + + + + +~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+ .. . . . .. . . . . . . . . . . . . . . . . . . . . . . . \/ \/ \/ \/ \/ +.....+ +.....+ +-.-.-.+ +~-~-~+ +......+ + + + + + + + + + + + MN + + MN + + MN + + MN + + MN + + + + + + + + + + + +.....+ +.....+ +-.-.-.+ +~-~-~+ +......+ The WDS include authentication and registration services for the APs. An AP provides Proxy Authentication and registration services for the MNs. The wireless connections are represented as dotted lines in the above diagram. GLOSSARY Access Point ( AP ) An entity that contains an 802.11 medium access control ( MAC ) and physical layer ( PHY ) interface and provides access to the distribution services via the wireless medium for associated clients. Mobile Node ( MN ) A roaming 802.11 wireless device in a wireless network associated with an access point. Wireless Domain Services (WDS) The set of services being offered at a particular broadcast domain that may be an IP subnet or a particular VLAN, or across the L3 cloud. The services include the following. 1. MN security credential caching to provide seamless, secure intra-subnet roaming. 2. Authenticated context transfer for roaming client within the subnet. Context The mobility context for an MN includes its current mobility bindings with the APs, IP/802 address bindings, cached configuration parameters, QoS state, IP group membership, authentication state, accounting statistics, and other dynamically derived protocol state information.
ciscoWdsIdsMIBObjects	1.3.6.1.4.1.9.9.457.1
ciscoWdsIdsMacSpoofing	1.3.6.1.4.1.9.9.457.1.1
I32 ciscoWdsIdsMaxMacAddresses	1.3.6.1.4.1.9.9.457.1.1.1	Integer32	read-write	This object indicates the maximum number of different MAC addresses for which spoofing events are held in this table.
I32 ciscoWdsIdsMaxEntriesPerMac	1.3.6.1.4.1.9.9.457.1.1.2	Integer32	read-write	This object indicates the maximum number of entries that can be held for a particular MAC address indicated by the object ciscoWdsIdsMacSpoofStaMacAddress.
ciscoWdsIdsMacSpoofTable	1.3.6.1.4.1.9.9.457.1.1.3		not-accessible	This table gives the information about the MAC spoofing attacks detected by the network entity offering WDS. An entry in this table is created by the agent when the WDS detects a MAC spoofing attack. The agent at anytime will retain only the most recent and maximum number of entries possible for a particular MAC. The older entries are purged automatically when the number of entries for a particular MAC reaches its maximum. Thus, there can be a maximum of those many different MAC addresses indicated by ciscoWdsIdsMaxMacAddresses and for each MAC address, the maximum number of entries is indicated by the value of the MIB object ciscoWdsIdsMaxEntriesPerMac. MAC spoofing is detected only by the network entity serving as the active WDS and hence this table is populated only by the active WDS as indicated by the values 'wds' and 'active' for the MIB objects cDot11csServiceType and cDot11csWdsInstanceState respectively. If cDot11csServiceType equals 'none' indicating that WDS is not configured in this station, or cDot11csWdsInstanceState not equals 'active' indicating that this entity is not the currently active WDS, a 'noSuchInstance' error is returned for the queries to the objects of this table.
ciscoWdsIdsMacSpoofEntry	1.3.6.1.4.1.9.9.457.1.1.3.1		not-accessible	An entry holds the information about one instance of MAC spoofing attack detected on the radio interface of the AP identified by ciscoWdsIdsMacSpoofStaMacAddress.
MAC ciscoWdsIdsMacSpoofStaMacAddress	1.3.6.1.4.1.9.9.457.1.1.3.1.1	MacAddress	not-accessible	This object identifies the radio interface of the 802.11 station, that has forwarded the authentication request of the client with the spoofed MAC address indicated by ciscoWdsIdsMacSpoofClient, to the WDS.
U32 ciscoWdsIdsMacSpoofIndex	1.3.6.1.4.1.9.9.457.1.1.3.1.2	Unsigned32	not-accessible	This object identifies the set of information about one instance of a MAC spoofing attack detected by the WDS. The radio interface of the 802.11 station that has forwarded the authentication request is identified by ciscoWdsIdsMacSpoofStaMacAddress.
MAC ciscoWdsIdsMacSpoofClient	1.3.6.1.4.1.9.9.457.1.1.3.1.3	MacAddress	read-only	This object indicates the MAC address that has been spoofed.
STR ciscoWdsIdsMacSpoofUserId	1.3.6.1.4.1.9.9.457.1.1.3.1.4	SnmpAdminString	read-only	This object indicates the userId used by the wireless client when attempting the MAC spoofing attack.
TIM ciscoWdsIdsMacSpoofDetectTime	1.3.6.1.4.1.9.9.457.1.1.3.1.5	TimeStamp	read-only	This object indicates the time at which this MAC spoofing attempt is detected by the WDS.
ciscoWdsIdsMIBConform	1.3.6.1.4.1.9.9.457.2
ciscoWdsIdsMIBCompliances	1.3.6.1.4.1.9.9.457.2.1
ciscoWdsIdsMIBCompliance	1.3.6.1.4.1.9.9.457.2.1.1			The compliance statement for the SNMP entities that implement the ciscoWdsIdsMIB module.
ciscoWdsIdsMIBGroups	1.3.6.1.4.1.9.9.457.2.2
ciscoWdsIdsMacSpoofingGroup	1.3.6.1.4.1.9.9.457.2.2.1			This collection of objects provide the information about the various attempts to spoof the MAC addresses of valid wireless clients in the network.

RFC description

Detects and reports 802.11 wireless security threats including MAC spoofing attempts on Cisco Wireless Domain Services.

Start monitoring Cisco IOS-based wireless access point or WDS-designated switch with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-WDS-IDS-MIB

What Is CISCO-WDS-IDS-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description