Brocade Mobility RFS Controller System Reference Guide (Supporting software release 5.5.0.0 and later) - Manual (Page 613)

Brocade Mobility RFS Controller System Reference Guide 601
53-1003099-01
10
FIGURE 22 WIPS Events screen - Excessive tab
The Excessive tab lists a series of events that can impact the performance of the network. An
administrator can enable or disable the filtering of each listed event and set the thresholds
required for the generation of the event notification and filtering action.
An Excessive Action Event is an event where an action is performed repetitively and
continuously. DoS attacks come under this category. Use the Excessive Action Events table to
select and configure the action taken when events are triggered.
13. Set the configurations of the following Excessive Action Events:
Name Displays the name of the excessive action event representing a potential threat to the network. This
column lists the event being tracked against the defined thresholds set for interpreting the event as
excessive or permitted.
Enable Displays whether tracking is enabled for each Excessive Action Event. Use the drop-down menu to
enable/disable events as required. A green checkmark defines the event as enabled for tracking against
its threshold values. A red “X” defines the event as disabled and not tracked by the WIPS policy. Each
event is disabled by default.
Filter Expiration Set the duration the anomaly causing client is filtered. This creates a special ACL entry and frames
coming from the client are silently dropped. The default setting is 0 seconds.
This value is applicable across the RF Domain. If a station is detected performing an attack and is filtered
by one of the APs, the information is passed to the domain controller or service platform. The domain
controller or service platform then propagates this information to all APs in the RF Domain.
Client Threshold Set the client threshold after which the filter is triggered and an event generated.
Radio Threshold Set the radio threshold after which an event is recorded to the events history.