All MIBs › WLSX-TRAP-MIB › wlsxHotspotterAttackDetected
wlsxHotspotterAttackDetected
Module: WLSX-TRAP-MIB
OID (symbolic): WLSX-TRAP-MIB::wlsxHotspotterAttackDetected
OID (numeric): 1.3.6.1.4.1.14823.2.3.1.11.1.2.1199
Node type: NOTIFICATION-TYPE
Description: This trap indicates that a new AP has appeared immediately following a client probe request. This is indicative of the Hotspotter tool or similar that attempts to trap clients with a fake hotspot or other wireless network. For more info check: http://www.wve.org/entries/show/WVE-2005-0054
Examples
Send this trap to an SNMP manager — replace <manager> with the IP or hostname of your monitoring server (SNMPv2c):
snmptrap -v2c -c public <manager> '' WLSX-TRAP-MIB::wlsxHotspotterAttackDetected snmptrap -v2c -c public <manager> '' 1.3.6.1.4.1.14823.2.3.1.11.1.2.1199
Listen for incoming traps on the manager host (-f keeps it in the foreground, -Lo prints to stdout — useful for testing):
snmptrapd -f -Lo -c /dev/null authCommunity log public
Example snmptrapd log entry:
zoo11-linux.zoo [UDP: [192.168.30.111]:58471->[192.168.30.10]:162]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (199834215) 23 days, 3:05:42.15 SNMPv2-MIB::snmpTrapOID.0 = OID: WLSX-TRAP-MIB::wlsxHotspotterAttackDetected
Start monitoring Aruba wireless LAN controllers, Aruba switches (stacked) (AP-connect/client-auth/ARM/VRRP notification status) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the WLSX-TRAP-MIB::wlsxHotspotterAttackDetected OID value, configure state conditions and alerts, and monitor any Aruba wireless LAN controllers, Aruba switches (stacked) (AP-connect/client-auth/ARM/VRRP notification status) from a single console.
OID Breakdown
Upper-level ancestors (10 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.14823 | aruba | AP80-PRIVATE-MIB |
| 1.3.6.1.4.1.14823.2 | arubaEnterpriseMibModules | AP80-PRIVATE-MIB |
| 1.3.6.1.4.1.14823.2.3 | arubaAp | AP80-PRIVATE-MIB |
| 1.3.6.1.4.1.14823.2.3.1 | wlsrEnterpriseMibModules | ARUBA-MIB |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.14823.2.3.1.11 | wlsrTrapMIB | WLSX-TRAP-MIB |
| 1.3.6.1.4.1.14823.2.3.1.11.1 | wlsxTrapsGroup | WLSX-TRAP-MIB |
| 1.3.6.1.4.1.14823.2.3.1.11.1.2 | wlsxTrapDefinitionsGroup | WLSX-TRAP-MIB |
| 1.3.6.1.4.1.14823.2.3.1.11.1.2.1199 | wlsxHotspotterAttackDetected | WLSX-TRAP-MIB |