The Wireless Clients tab is where you assign BSS thresholds that apply to any individual Wireless Client. These thresholds will typically be lower than the aggregate Wireless Client thresholds. AirDefense generates an alarm if any single Wireless Client reaches one of these thresholds. From these alarms, you can identify the high bandwidth users, and the times they are using the network. You should base Wireless Client thresholds on either the normal transmission rate for your wireless LAN, or on arbitrary numbers designed to detect your high-bandwidth users..
Note
Entering a 0 (zero) for any threshold-type disables that specific alarm.
The thresholds are:
| Threshold | Description |
|---|---|
|
Traffic Sent % |
Enter the maximum percentage of data per minute any Wireless Client is allowed transmit. If AirDefense detects a greater number, it generates an alarm. Default = 30. |
|
Traffic Received % |
Enter the maximum percentage of data per minute any Wireless Client is allowed to receive. If AirDefense detects a greater number, it generates an alarm. Default = 30. |
|
Data Frames Sent |
Enter the maximum number of data frames per minute any Wireless Client is allowed to transmit. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Data Frames Received |
Enter the maximum number of data frames per minute any Wireless Client is allowed to receive. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Management Frames Sent |
Enter the maximum number of management frames per minute any Wireless Client is allowed to transmit. If AirDefense detects a greater number, it generates an alarm. Default = 0. Management frames carry information related to negotiating network connections. If many more Management frames per minute than usual are detected, this could indicate a malicious disassociation or other form of Denial-of-Service attack. |
|
Management Frames Received |
Enter the maximum number of management frames per minute any Wireless Client is allowed to receive. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Control Frames Sent |
Enter the maximum number of control frames per minute any Wireless Client is allowed to transmit. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Control Frames Received |
Enter the maximum number of control frames per minute any Wireless Client is allowed to receive. If AirDefense detects a greater number, an alarm is generated. Default = 0. Control frames carry information about negotiating the 802.11 protocol for getting data onto the airwaves, and are transmitted at only 1 Mbs. Unusually high numbers of Control frames may indicate bandwidth and network problems. |
|
Fragment Frames Sent |
Enter the maximum number of fragment frames per minute that are allowed from any Wireless Client. If AirDefense detects a greater number, it generates an alarm. Default = 1. |
|
Association Frames Sent |
Enter the maximum number of association frames allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Disassociation Frames Sent |
Enter the maximum number of disassociation frames allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
802.11 Authentication Frames Sent |
Enter the maximum number of 802.11 authentication frames allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
802.1x Authentication Frames Sent |
Enter the maximum number of 802.1x authentication frames allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Deauthentication Frames Sent |
Enter the maximum number of deauthentication frames allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Probe Responses Sent |
Enter the maximum number of probe requests allowed to be transmitted from all Wireless Clients. If AirDefense detects a greater number, it generates an alarm. Default = 0. |
|
Retransmission Frames Sent % |
Enter the maximum percentage of data per minute that a station can retransmit as frames. If AirDefense detects a greater number, it generates an alarm. Default = 0. |