CISCO-DOT11-WIDS-MIB
AI MIB Summary
The CISCO-DOT11-WIDS-MIB monitors Cisco IOS-based 802.11 Access Points to track specific Wireless Intrusion Detection System (WIDS) events, including EAPOL flooding attempts, client blacklisting triggers, and 802.11 data protection failures. It exposes counters and thresholds for these security anomalies to Network Management Stations, enabling the detection of authentication denial-of-service attacks and packet injection corruption within the wireless infrastructure.
This MIB is intended to be implemented on the following IOS based network entities for the purpose of providing network management stations information about the various attempts to compromise the security in the 802.11-based wireless networks.
(i) 802.11 Access Points that accept wireless client associations.
The MIB reports the information about the following attacks that can happen either at the initial authentication phase or during normal data communication between the client and the AP.
EAPOL flooding - This is an attempt made by an invalid 802.11 client to send too many EAPOL-Start messages and bring the authentication services on the Authenticator, typically the AP, down.
BlackListing - This is the process of marking a client as invalid when its authentication attempts fail. The client is put in a list when its authentication attempt fails for the first time. If the number of consecutive failed authentication attempts reach a threshold, any subsequent authentication requests made by the client will be rejected from that point for a configurable period of time.
Protection Failures - These kind of failures happen when the attacker injects invalid packets onto the wireless network thereby corrupting the
802.11 data traffic between an AP and its
associated wireless clients.
The administrator, through the NMS, can configure the thresholds on the AP using this MIB to enable the AP detect the EAPOL flood attacks and provide related statistics to the NMS.
To detect protection failures, the AP provides the relevant statistics about the protection errors in the form of MIB objects, which are compared against the thresholds configured on the NMS and appropriate events are raised by the NMS, if thresholds are found to be exceeded.
The hierarchy of the AP and MNs is as follows.
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
+ + + + + + + +
+ AP + + AP + + AP + + AP +
+ + + + + + + +
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
.. . . . .. . . . . . . . . . . . . . . . . . . . . . . . \/ \/ \/ \/ \/
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
+ + + + + + + + + +
+ MN + + MN + + MN + + MN + + MN +
+ + + + + + + + + +
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
The wireless connections are represented as dotted lines in the above diagram.
GLOSSARY
Access Point ( AP )
An entity that contains an 802.11 medium access control ( MAC ) and physical layer ( PHY ) interface and provides access to the distribution services via the wireless medium for associated clients.
Mobile Node ( MN )
A roaming 802.11 wireless device in a wireless network associated with an access point.
Service Set Identifier (SSID)
The Radio Service Set ID that is used by the mobile wireless clients for identification during the association with the APs.
Temporal Key Integrity Protocol (TKIP)
A security protocol defined to enhance the limitations of WEP. Message Integrity Check and per-packet keying on all WEP-encrypted frames are two significant enhancements provided by TKIP to WEP.
Counter mode with CBC-MAC Protocol (CCMP)
A security protocol that uses the counter mode in conjunction with cipher block chaining. This method divides the data into blocks, encrypts the first block, XORs the results with the second block, encrypts the result, XORs the result with the next block and continues till all the blocks are processed. This way, this protocol derives a 64-bit MIC which is appended to the plaintext data which is again encrypted using the counter mode.
Message Integrity Check (MIC)
The Message Integrity Check is an improvement over the Integrity Check Function (ICV) of the 802.11 standard. MIC adds two new fields to the wireless frames - a sequence number field for detecting out-of-order frames and a MIC field to provide a frame integrity check to overcome the mathematical shortcomings of the ICV.
802.1x
The IEEE ratified standard for enforcing port based access control. This was originally intended for use on wired LANs and later extended for use in
802.11 WLAN environments. This defines an
architecture with three main parts - a supplicant (Ex. an 802.11 wireless client), an authenticator (the AP) and an authentication server(a Radius server). The authenticator passes messages back and forth between the supplicant and the authentication server to enable the supplicant get authenticated to the network.
Extensible Authentication Protocol Over LAN (EAPOL)
This is an encapsulation method defined by 802.1x passing EAP packets over Ethernet frames.
Main OID:
ciscoDot11WidsMIB.1.3.6.1.4.1.9.9.456
42
Objects
Active
Status
5
Dependencies
Imported Objects
Objects
42 total| Object Name |
|---|
ciscoDot11WidsMIBThis MIB is intended to be implemented on the
following IOS based network entities for the purpose
of providing network management stations information
about the various attempts to compromise the security
in the 802.11-based wireless networks.
(i) 802.11 Access Points that accept wireless client
associations.
The MIB reports the information about the following
attacks that can happen either at the initial
authentication phase or during normal data
communication between the client and the AP.
EAPOL flooding - This is an attempt made by an
invalid 802.11 client to send too many EAPOL-Start
messages and bring the authentication services
on the Authenticator, typically the AP, down.
BlackListing - This is the process of marking
a client as invalid when its authentication
attempts fail. The client is put in a list
when its authentication attempt fails for the
first time. If the number of consecutive
failed authentication attempts reach a threshold,
any subsequent authentication requests made by
the client will be rejected from that point for
a configurable period of time.
Protection Failures - These kind of failures
happen when the attacker injects invalid packets
onto the wireless network thereby corrupting the
802.11 data traffic between an AP and its
associated wireless clients.
The administrator, through the NMS, can configure
the thresholds on the AP using this MIB to enable
the AP detect the EAPOL flood attacks and provide
related statistics to the NMS.
To detect protection failures, the AP provides the
relevant statistics about the protection errors in
the form of MIB objects, which are compared against
the thresholds configured on the NMS and appropriate
events are raised by the NMS, if thresholds are
found to be exceeded.
The hierarchy of the AP and MNs is as follows.
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
+ + + + + + + +
+ AP + + AP + + AP + + AP +
+ + + + + + + +
+~-~-~+ +~-~-~+ +~-~-~+ +~-~-~+
.. . . .
.. . . .
. . . . .
. . . . .
. . . . .
. . . . .
\/ \/ \/ \/ \/
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
+ + + + + + + + + +
+ MN + + MN + + MN + + MN + + MN +
+ + + + + + + + + +
+.....+ +.....+ +-.-.-.+ +~-~-~+ +......+
The wireless connections are represented as dotted
lines in the above diagram.
GLOSSARY
Access Point ( AP )
An entity that contains an 802.11 medium access
control ( MAC ) and physical layer ( PHY ) interface
and provides access to the distribution services via
the wireless medium for associated clients.
Mobile Node ( MN )
A roaming 802.11 wireless device in a wireless
network associated with an access point.
Service Set Identifier (SSID)
The Radio Service Set ID that is used by the mobile
wireless clients for identification during the
association with the APs.
Temporal Key Integrity Protocol (TKIP)
A security protocol defined to enhance the limitations
of WEP. Message Integrity Check and per-packet keying
on all WEP-encrypted frames are two significant
enhancements provided by TKIP to WEP.
Counter mode with CBC-MAC Protocol (CCMP)
A security protocol that uses the counter mode in
conjunction with cipher block chaining. This method
divides the data into blocks, encrypts the first
block, XORs the results with the second block,
encrypts the result, XORs the result with the next
block and continues till all the blocks are
processed. This way, this protocol derives a
64-bit MIC which is appended to the plaintext data
which is again encrypted using the counter mode.
Message Integrity Check (MIC)
The Message Integrity Check is an improvement over the
Integrity Check Function (ICV) of the 802.11 standard.
MIC adds two new fields to the wireless frames - a
sequence number field for detecting out-of-order
frames and a MIC field to provide a frame integrity
check to overcome the mathematical shortcomings of
the ICV.
802.1x
The IEEE ratified standard for enforcing port based
access control. This was originally intended for
use on wired LANs and later extended for use in
802.11 WLAN environments. This defines an
architecture with three main parts - a supplicant
(Ex. an 802.11 wireless client), an authenticator
(the AP) and an authentication server(a Radius
server). The authenticator passes messages back
and forth between the supplicant and the
authentication server to enable the supplicant
get authenticated to the network.
Extensible Authentication Protocol Over LAN (EAPOL)
This is an encapsulation method defined by 802.1x
passing EAP packets over Ethernet frames. MODULE-IDENTITY .1.3.6.1.4.1.9.9.456 |
ciscoDot11WidsMIBNotifs OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.0 |
ciscoDot11WidsMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.1 |
ciscoDot11WidsAuthFailures OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.1.1 |
cDot11WidsFloodDetectEnableThis object is used to enable or disable the WIDS
flood detection feature.
Set this MIB object to 'true' to enable the
flood detection and 'false' to disable it.
Note that the values configured through
cDot11WidsFloodThreshold and
cDot11WidsEapolFloodInterval take effect only if
flood detection is enabled through this MIB
object.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.1 |
cDot11WidsEapolFloodThresholdThis object specifies the maximum number of
authentication attempts allowed for all the clients
taken together in the interval specified by
cDot11WidsEapolFloodInterval. The attempts include
both the successful as well as failed attempts.rw Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.2 |
cDot11WidsEapolFloodIntervalThis object specifies the time duration for
which the client authentication attempts have to
be monitored for detecting the flood attack.rw Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.3 |
cDot11WidsBlackListThresholdThis object configures the maximum threshold on
the number of unsuccessful authentication attempts,
that can be made by a particular client. Once the
threshold is reached, the client is retained in the
list for a period of time equal to the value
configured through cDot11WidsBlackListDuration,
during which its attempts to get authenticated
are blocked.rw Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.4 |
cDot11WidsBlackListDurationThis object indicates the time duration for which a
particular client has to be kept in the black list
after the number of unsuccessful attempts reach the
threshold given by cDot11WidsBlackListThreshold.rw Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.5 |
cDot11WidsFloodMaxEntriesPerIntfThis object indicates the maximum number of entries
that can be held for a particular 802.11 radio
interface identified by ifIndex.rw Integer32 .1.3.6.1.4.1.9.9.456.1.1.6 |
cDot11WidsEapolFloodTableThis table gives the statistics on the EAPOL flood
attacks observed at this radio interface.
An entry in this table is created by the agent when
this 802.11 station detects an EAPOL flood attack.
All the columns in the entries except the
cDot11WidsEapolFloodStopTime are populated when
the attack is observed first. The object
cDot11WidsEapolFloodStopTime is populated when no
flood conditions are observed following the initial
observation at the time indicated by
cDot11WidsEapolFloodStartTime.
This can be illustrated by the following example.
Assume that the monitoring interval is configured
to 1 minute through the
cDot11WidsEapolFloodInterval object and the number
of attempts is set to 5.
At the end of the first minute after this
configuration is made, client c1 is found to
have made 4 attempts and another client c2 have
made 3. Hence, in total, the attempt count
exceeds 7 and the agent adds a new row to this
table. The cDot11WidsFloodStopTime carries a
value of 0 at this point in the newly added row.
The MIB object cDot11WidsEapolFloodClientMac
at this point holds the MAC address of c1
and cDot11WidsEapolFloodClientCount holds the
value of 4.
At the end of the second interval, assume that
the clients are found to have made only 4
attempts in total with c1 and c2 making 3 and 1
attempt(s) respectively. Now the total count
is not found to exceed the threshold. Hence
the flood is observed to be stopped. The
object cDot11WidsEapolFloodStopTime is now
populated with this time at which the flood is
observed to be stopped. The MIB object
cDot11WidsEapolFloodClientMac at this point
holds c1's MAC address and
cDot11WidsEapolFloodClientCount would hold a
value of 7. If the count is found to exceed in
the next interval, it will be treated as a
beginning of a new flood event and hence a new
entry will be created for the same.
Assume the case where, at the end of the second
interval, the total count continues at the
rate above the threshold, with c1 making 5 and
c2 making 2 attempts respectively. Since the
flood is not observed to be stopped, the
object cDot11WidsFloodStopTime continues to
hold a value of zero.
The agent at anytime will retain only the most
recent and maximum number of entries, as given
by cDot11WidsFloodMaxEntriesPerIntf, for a
particular value of ifIndex. The older entries
are purged automatically when the number of
entries for a particular ifIndex reaches its
maximum.
This table has a expansion dependent relationship
with ifTable defined in IF-MIB. There exists a
row in this table corresponding to the row for each
interface of iftype ieee80211(71) found in ifTable.
cDot11WidsEapolFloodIndex acts as the
expansion index. SEQUENCE OF CDot11WidsEapolFloodEntry .1.3.6.1.4.1.9.9.456.1.1.7 |
cDot11WidsEapolFloodEntryAn entry holds the statistics about one instance of
EAPOL flood attack observed at this particular
radio interface. CDot11WidsEapolFloodEntry .1.3.6.1.4.1.9.9.456.1.1.7.1 |
cDot11WidsEapolFloodIndexThis object identifies the set of information about
one instance of an EAPOL flood event observed at
this radio interface between the start and stop
times indicated by cDot11WidsEapolFloodStartTime
and cDot11WidsEapolFloodStopTime. Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.7.1.1 |
cDot11WidsEapolFloodClientMacThis object identifies the MAC address of the
wireless client that has made the maximum
number of authentication attempts in the
duration specified by the
cDot11WidsEapolFloodInterval object.
At the end of each interval time indicated by
cDot11WidsFloodInterval, the 802.11 station
checks whether the total count of the number of
authentication attempts made by all the clients
exceed the threshold configured through the
object cDot11WidsEapolFloodThreshold. If yes,
then the agent populates this MIB object
with the MAC of the wireless client that has
made the maximum number of authentication
attempts in that interval.
When the flood event is observed to be stopped,
as indicated by a non-zero value for the
cDot11WidsEapolFloodStopTime object,
this object indicates the MAC of the wireless
client that has made the maximum number of
attempts for the entire duration of the flood
observed between the times indicated by the
objects cDot11WidsEapolFloodStartTime and
cDot11WidsEapolFloodStopTime respectively.ro MacAddress (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.7.1.2 |
cDot11WidsEapolFloodClientCountThis object provides the count associated with
the client with largest number of attempts in
the last interval.
When the flood event is observed to be stopped,
as indicated by a non-zero value for the
cDot11WidsEapolFloodStopTime object, this
object gives the count associated with the
client with the largest number of attempts,
for the entire duration of the flood observed
between the times indicated by the objects
cDot11WidsEapolFloodStartTime and
cDot11WidsEapolFloodStopTime respectively.ro Unsigned32 .1.3.6.1.4.1.9.9.456.1.1.7.1.3 |
cDot11WidsEapolFloodStartTimeThis object indicates the time at which the
EAPOL flood event identified by one entry of
this table was observed first at this radio
interface.ro TimeStamp (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.7.1.4 |
cDot11WidsEapolFloodStopTimeThis object indicates the time at which the
the EAPOL flood event observed first at the
time indicated by cDot11WidsEapolFloodStartTime
has stopped.
If this 802.11 station finds that the flood
conditions observed in the one or more prior
intervals has ceased, it marks the flood
event as stopped at the time indicated by
this object. That the flood has ceased is
indicated by the number of authentication
attempts dropping below the value specified by
the cDot11WidsEapolFloodThreshold object.
A value of 0 for this object indicates that
the number of authentication attempts continue
to exceed the value specified by the
cDot11WidsEapolFloodThreshold object.ro TimeStamp (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.7.1.5 |
cDot11WidsEapolFloodTotalCountThis object gives the accumulated count of the
number of authentication attempts made by all the
clients at the time of query.ro Counter32 .1.3.6.1.4.1.9.9.456.1.1.7.1.6 |
cDot11WidsBlackListTableThis table gives the information about the
802.11 wireless clients that have been blacklisted
while attempting to get authenticated with this
802.11 station at this radio interface.
An entry is added to this table when the number
of consecutive failed authentication attempts
made by a client equals the value configured
through cDot11WidsBlackListThreshold. The
client will then be blocked from getting
authenticated for a time period equal to the
value configured through
cDot11WidsBlackListDuration. After this time
elapses, the client is taken off from the list
and the agent automatically removes the entry
corresponding to that client from this table.
This table has a expansion dependent relationship on
the ifTable. For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71). cDot11BlackListIndex acts as the
expansion index. SEQUENCE OF CDot11WidsBlackListEntry .1.3.6.1.4.1.9.9.456.1.1.8 |
cDot11WidsBlackListEntryEach entry holds the information about one
802.11 wireless client that has been blacklisted
when attempting to get authenticated with
this 802.11 station at this radio interface. CDot11WidsBlackListEntry .1.3.6.1.4.1.9.9.456.1.1.8.1 |
cDot11WidsBlackListClientMacThis object indicates the Mac Address of the
blacklisted client. MacAddress (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.8.1.1 |
cDot11WidsBlackListAttemptCountThis object counts the total number of attempts
made by the client identified by
cDot11WidsBlackListClientMac to get authenticated
with the 802.11 station through this radio
interface.ro Counter32 .1.3.6.1.4.1.9.9.456.1.1.8.1.2 |
cDot11WidsBlackListTimeThis object indicates the time at which the client
was blacklisted after failing in its attempt to get
authenticated with this 802.11 station at this radio
interface.ro TimeStamp (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.1.8.1.3 |
ciscoDot11WidsProtectFailures OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.1.2 |
cDot11WidsProtectFailClientTableThis table gives the statistics on the various
protection failures occurred during the data
communication of this 802.11 station with a
particular client currently associated at this
dot11 interface.
Note that the agent populates this table with an
entry for an associated client if and only if
at least one of the error statistics, as reported
by the counter-type objects of this table, has a
non-zero value.
This table has a expansion dependent relationship on
the ifTable. For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71). cDot11WidsSsid and
cDot11WidsClientMacAddress act as the
expansion indices. SEQUENCE OF CDot11WidsProtectFailClientEntry .1.3.6.1.4.1.9.9.456.1.2.1 |
cDot11WidsProtectFailClientEntryEach entry holds the information about the
protection failures observed at this radio
interface when this 802.11 station communicates with
its associated client identified by
cDot11WidsClientMacAddress at the interface
identified by ifIndex. The clients are grouped
according to the SSIDs they use for their
association with the dot11 interface. CDot11WidsProtectFailClientEntry .1.3.6.1.4.1.9.9.456.1.2.1.1 |
cDot11WidsSsidThis object specifies one of the SSIDs of this
radio interface using which the client has
associated with the 802.11 station. OCTET STRING .1.3.6.1.4.1.9.9.456.1.2.1.1.1 |
cDot11WidsClientMacAddressThis object identifies the MAC address of the
associated client to which this set of
statistics are applicable. MacAddress (SNMPv2-TC) .1.3.6.1.4.1.9.9.456.1.2.1.1.2 |
cDot11WidsSelPairWiseCipherThis object identifies the pairwise cipher used by
the client identified by cDot11WidsClientMacAddress
during its association with this 802.11 station
at the interface identified by ifIndex.ro OCTET STRING .1.3.6.1.4.1.9.9.456.1.2.1.1.3 |
cDot11WidsTkipIcvErrorsThis object counts the total number of TKIP ICV
Errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the
radio interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.4 |
cDot11WidsTkipLocalMicFailuresThis object counts the total number of TKIP local
MIC failures observed in the data communication
between this 802.11 station and the client
indicated by cDot11WidsClientMacAddress since
the client's association with this 802.11 station
at the radio interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.5 |
cDot11WidsTkipRemoteMicFailuresThis object counts the total number of TKIP remote
MIC failures observed in the data communication
between this 802.11 station and the client
indicated by cDot11WidsClientMacAddress since the
client's association with this 802.11 station
at the radio interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.6 |
cDot11WidsCcmpReplaysThis object counts the total number of CCMP replay
failures observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.7 |
cDot11WidsCcmpDecryptErrorsThis object counts the total number of CCMP
decryption failures observed in the data
communication between this 802.11 station and
the client indicated by cDot11WidsClientMacAddress
since the client's association with this
802.11 station at the radio interface identified
by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.8 |
cDot11WidsTkipReplaysThis object counts the total number of TKIP
replay failures observed in the data
communication between this 802.11 station and the
client indicated by cDot11WidsClientMacAddress
since the client's association with this
802.11 station at the radio interface identified
by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.9 |
cDot11WidsWepReplaysThis object counts the total number of WEP Replay
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.10 |
cDot11WidsWepIcvErrorsThis object counts the total number of WEP ICV
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.11 |
cDot11WidsCkipReplaysThis object counts the total number of CKIP replay
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the radio
interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.12 |
cDot11WidsCkipCmicErrorsThis object counts the total number of CKIP-CMIC
errors observed in the data communication between
this 802.11 station and the client indicated by
cDot11WidsClientMacAddress since the client's
association with this 802.11 station at the
radio interface identified by ifIndex.ro Counter32 .1.3.6.1.4.1.9.9.456.1.2.1.1.13 |
ciscoDot11WidsMIBConform OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.2 |
ciscoDot11WidsMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.2.1 |
ciscoDot11WidsMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.456.2.2 |