Motorola WiNG 5.5 Reference Manual page 602

8 - 32 WiNG 5.5 Access Point System Reference Guide
MU Anomaly events are suspicious events by wireless clients that can compromise the security and stability of the network.
Use the MU Anomaly screen to set the intervals clients can be filtered upon the generation of each event.
14. Set the following
Name
Enable
Filter Expiration
15. Select OK to save the updates to the MU Anomaly configuration used by the WIPS policy. Select
saved configuration. The WIPS policy can be invoked at any point in the configuration process by selecting
Wireless IPS Policy
16. Select the AP Anomaly
configuration parameters.
MU Anomaly Event configurations:
Displays the name of the excessive action event representing a potential threat to the
network. This column lists the event being tracked against the defined thresholds set for
interpreting the event as excessive or permitted.
Displays whether tracking is enabled for each MU Anomaly event. Use the drop-down
menu to enable/disable events as required. A green checkmark defines the event as
enabled for tracking against its threshold. A red "X" defines the event as disabled, and
not tracked by the WIPS policy. Each event is disabled by default.
Set the duration a client is filtered. This creates a special ACL entry, and frames coming
from the client are silently dropped. The default setting is 0 seconds. For each violation,
define a time to filter value (in seconds) which determines how long received packets are
ignored from an attacking device once a violation has been triggered. Ignoring frames
from an attacking device minimizes the effectiveness of the attack and the impact to the
site until permanent mitigation can be performed.
from the upper, left-hand side, of the access point user interface.
tab. Ensure the Activate Wireless IPS Policy
Reset
option remains selected to enable the screen's
to revert to the last
Activate