HH3C-WIPS-MIB: View SNMP OID List / Download MIB

This MIB provides information about WIPS feature. Wireless Intrusion Prevention System (WIPS) WIPS is designed to be employed in an area that is serviced by an existing wireless network. It aids in the early detection of malicious outsider attacks and intrusions via wireless networks, and takes corresponding measures in order to guarantee the wireless environment security.

Represents whether the WIPS feature is enabled or not. 'true': enable the WIPS feature. 'false': disable the WIPS feature.

Represents the number of sensor license.

Represents whether the block list feature is enabled or not. 'block' : Enable the block list feature to filter unwanted devices. 'unblock' : Disable the block list feature. Enumeration: 'unblock': 2, 'block': 1.

Represents the time for AP getting inactive.

Represents the time for STA getting inactive.

Represents the time for device getting aged.

Represents the period of WIPS reporting the statistic.

Represents the period of WIPS reclassifying devices.

This object is used to remove all entries from the static trust list. It will return false for get operation.

This object is used to remove all entries from the static block list. It will return false for get operation.

This object is used to remove all entries from the ignore list. It will return false for get operation..

This object is used to remove all entries from the static countermeasure list. It will return false for get operation.

Represents the permit channel number by bitmap.

Represents the time for devices in the dynamic trust list getting aged.

Represents the period of WIPS update the status of devices.

Represents whether enable the ADOS feature. 'true': enable the ADOS feature. 'false': disable the ADOS feature.

Represents whether the WIPS scanning feature during the access flow is enabled or not. 'true': enable the feature. 'false': disable the feature.

The table provides the list of virtual security domain.

Each entry contains information of each VSD.

Represents the name of virtual security domain.

The status of this table entry.

Represents the name of attack detect policy attached to the VSD.

Represents the name of countermeasure policy attached to the VSD.

Represents the name of signature policy attached to the VSD

Represents the name of malformed packet detect policy attached to the VSD

The table defines the AP classification rules been attached to the VSD.

Each entry contains information of each AP classification rule in each VSD.

Represents the name of AP classification rule attached to the VSD.

The status of this table entry.

Represents the precedence of AP classification rule attached to the VSD.

The table defines the sensor been attached to the VSD.

Each entry contains information of each sensor in each VSD.

Represents the name of sensor attached to the VSD.

The status of this table entry.

Represents the running state of the sensor. It will return false for set operation. Enumeration: 'running': 1, 'idle': 2.

The table represents the list of sensor radio information.

Each entry contains information of a radio of a sensor.

Represents the radio identifier of the sensor.

Represents the scanning mode configured to the radio. Enumeration: 'middle': 3, 'detectFirst': 2, 'accessFirst': 1, 'detectOnly': 4.

The table defines the parameters for WIPS AP classification rule. One rule could be assigned to different VSDs.

Each entry contains information of each AP classification rule.

Represents the name of AP classification rule.

The status of this table entry.

Represents the severity level of the AP classification rule. Available value limits from 0 to 100.

Represents whether match all the AP classification sub-rules which have been configured.

Represents the type of AP classification.

Represents the compare way of the SSID in the sub rule, including include/not include/equal/not equal. Enumeration: 'notequal': 4, 'include': 1, 'notinclude': 2, 'equal': 3.

Represents the case sensitive or not for the SSID match. 'true': Case insensitive. 'false': Case sensitive.

Represents the SSID match template in the ap classification rule.

Represents the security type of active AP.

Represents match way of the security type of active AP. Enumeration: 'include': 2, 'equal': 1.

Represents the authentication type of the AP. undo - represents undo operation Enumeration: 'noneANDpskANDdot1x': 13, 'psk': 2, 'none': 1, 'noneANDpskANDdot1xANDother': 16, 'noneANDpskANDother': 14, 'pskANDdot1xANDother': 9, 'dot1xANDother': 8, 'pskANDdot1x': 6, 'undo': 5, 'dot1x': 3, 'other': 4, 'noneANDdot1x': 11, 'noneANDother': 12, 'noneANDdot1xANDother': 15, 'pskANDother': 7, 'noneANDpsk': 10.

Represents the high-limit of the RSSI of AP. Available value limits from 1 to 90.

Represents the low-limit of the RSSI of AP. Available value limits from 0 to 89.

Represents the high-limit of the duration of AP. Available value limits from 1 to 2592000.

Represents the low-limit of the duration of AP. Available value limits from 0 to 2591999.

Represents the high-limit of the number of AP. Available value limits from 1 to 128.

Represents the low-limit of the number of AP. Available value limits from 0 to 127.

Represents the high-limit of the number of client. Available value limits from 1 to 128.

Represents the low-limit of the number of client. Available value limits from 0 to 127.

Represents the OUI hexadecimal string of the AP.

Represents the vendor info of the AP.

Represents match way of the authentication type of active AP. Enumeration: 'include': 2, 'equal': 1.

Represents the bit string of supported attack detect policy. The specific attack detect policy is supported if its corresponding bit is set to 1; otherwise its corresponding bit is set to 0. bit0: adhoc bit1: ap-spoof bit2: client-spoof bit3: prohibited channel bit4: ap-flood bit5: eapol-start bit6: authentication bit7: association bit8: reassociation bit9: weak-IV bit10: invalid-OUI bit11: ps-attack bit12: windows-bridge bit13: hotspot-attack bit14: ap-impersonation bit15: soft-ap bit16: unencrypted-authorized-ap bit17: unencrypted-trust-client

The table defines the parameters for WIPS attack detect policy.

Each entry contains information of each attack detect policy.

Represents the name of attack detect policy.

The status of this table entry.

Represents the bit string of attack detect policy configuration. The specific attack detect policy is enabled if its corresponding bit is set to 1; disabled if its corresponding bit is set to 0. bit0: adhoc bit1: ap-spoof bit2: client-spoof bit3: prohibited channel bit4: ap-flood bit5: eapol-start bit6: authentication bit7: association bit8: reassociation bit9: weak-IV bit10: invalid-OUI bit11: ps-attack bit12: windows-bridge bit13: hotspot-attack bit14: ap-impersonation bit15: soft-ap bit16: unencrypted-authorized-ap bit17: unencrypted-trust-client

Represents the quiet time after reporting the AP flood attack event alarm.

Represents the quiet time after reporting the AP spoofing attack event alarm.

Represents the quiet time after reporting the client spoofing attack event alarm.

Represents the quiet time after reporting the dos of association attack event alarm.

Represents the quiet time after reporting the dos of authentication attack event alarm.

Represents the quiet time after reporting the dos of EAPOL-start attack event alarm.

Represents the quiet time after reporting the dos of reassociation attack event alarm.

Represents the quiet time after reporting the weak-IV event alarm.

Represents the action after detecting the invalid OUI, which classify the device as rogue device. Enumeration: 'none': 0, 'rogue': 1.

Represents the quiet time after reporting the unencrypted-authorized-ap event alarm.

Represents the quiet time after reporting the unencrypted-trust-client event alarm.

Represents the quiet time after reporting the ps-attack event alarm.

Specify the minimum number of OFF packets as threshold in detecting ps-attack.

Specify the ratio of ON packets to OFF packets in percentage as threshold in detecting ps-attack.

Represents the quiet time after reporting the ap-impersonation event alarm.

Specify the increased percentage threshold for beacon frames that can trigger an AP impersonation alert

Specify the waiting time before a suspected AP is determined as an AP impersonator. If the beacon frames keep on increasing beyond the threshold during the waiting time, then the suspected AP should be determined as an AP impersonator.

Specify the minimum client-AP switchover threshold used to determine a soft AP

The table provides the MAC address list of devices in the static countermeasure list.

Each entry contains information of each MAC address in the static countermeasure list.

Represents the MAC address in static countermeasure list.

The status of this table entry.

The table provides the MAC address list of devices in the static block list. WIPS will ignore the frames from the devices in the list, and take the devices as rogue devices.

Each entry contains information of each MAC address in the static block list.

Represents the MAC address in static block list.

The status of this table entry.

The table provides the MAC address list of devices in the static trust list. WIPS will take the devices in the list as authorized devices.

Each entry contains information of each MAC address in the static trust list.

Represents the MAC address in static trust list.

The status of this table entry.

The table provides the MAC address list of devices in the ignore list. WIPS will ignore the events caused by the device in the list.

Each entry contains information of each MAC address in the ignore list.

Represents the MAC address in ignore list.

The status of this table entry.

The table represents the list of AP scanning mode configuration on radio.

Each entry contains information of WIPS scanning mode on radio.

Represents the name of AP.

Represents the radio of AP.

Represents the scanning mode. The radio enable-disable status must be disabled before WIPS scanning mode is configured on this radio. The mesh feature must be disabled before any WIPS scanning mode is set on radio. This radio can not apply any service template before the detectOnly scanning mode is set on the radio. Enumeration: 'middle': 3, 'detectFirst': 2, 'accessFirst': 1, 'detectOnly': 4.

The status of this table entry.

The table defines the parameters for WIPS signature policy. One policy could be assigned to different VSDs.

Each entry contains information of each signature policy.

Represents the name of signature policy.

The status of this table entry.

The table defines the signature rules been attached to the signature policy.

Each entry contains information of each signature rules attached to signature policy.

Represents the ID of signature rule attached to signature policy.

The status of this table entry.

Represents the precedence of signature rule attached to signature policy.

The table defines the signature rules.

Each entry contains information of each signature rules.

Represents the name of signature rule.

Represents the ID of signature rule. The values from 1 to 32 are for built-in rules, which can not be assigned to user-define rules. When a user-define signature rule is being created, if ID is not specified, the ID of the rule will be automatically assigned, which values from 33 to 64. Once the rule is created, the ID is fixed and can not be changed again.

The status of this table entry.

Represents whether match all the sub rules which have been configured in the signature rule. The default value for user-define rule is false, and for built-in rule is true.

Represents the detect period of signature rule. Available value limits from 1 to 3600. The default value depends on the certain rule. For user-define rules it is 60. The value 0xffffffff represents restoring default value operation.

Represents the track-method for the signature rule. The default value depends on the certain rule. For user-define rules it is 'both(3)'. Enumeration: 'perMAC': 2, 'both': 3, 'perSig': 1.

Represents the detect threshold for per-MAC track-method. Available value limits from 1 to 32000. The default value depends on the certain rule. For user-define rules it is 1000. The value 0xffffffff represents restoring default value operation.

Represents the detect threshold for per-Signature track-method. Available value limits from 1 to 32000. The default value depends on the certain rule. For user-define rules it is 1000. The value 0xffffffff represents restoring default value operation.

Represents the level of event sended for the action of reporting event alarm. Available value limits from 0 to 7. The default value depends on the certain rule. For user-define rules it is 0xffffffff.

Represents the quiet time after reporting event alarm. Available value limits from 60 to 32000. The default value depends on the certain rule. For user-define rules it is 900. The value 0xffffffff represents restoring default value operation.

Represents the type of frame to match. 0x0 management type 0x1 control type 0x2 data type The default value depends on the certain rule. For user-define rules it is 'undo(3)'. Enumeration: 'control': 1, 'manage': 0, 'data': 2, 'undo': 3.

Represents the sub-type of frame to match. 1 association request 2 association response 3 probe request 4 beacon 5 disassoc 6 authentication 7 de-authentication The default value depends on the certain rule. For user-define rules it is 'none(0)'. Enumeration: 'deauth': 7, 'none': 0, 'assocRes': 2, 'assocReq': 1, 'disasso': 5, 'auth': 6, 'beacon': 4, 'probeReq': 3.

Represents the MAC address or BSSID to match.

Represents the type of MAC address or BSSID to match. 0 Source MAC address in the 802.11 frame header 1 Destination MAC address in the 802.11 frame header 2 BSSID field in the 802.11 frame header Enumeration: 'dest': 1, 'source': 0, 'bssid': 2.

Represents the minimun value of sequence number of packet to match. Available value limits from 0 to 4094. The default value depends on the certain rule. For user-define rules it is 0xffffffff. The value 0xffffffff represents restoring default value operation.

Represents the maximum value of sequence number of packet to match. Available value limits from 1 to 4095. The default value depends on the certain rule. For user-define rules it is 0xffffffff. The value 0xffffffff represents restoring default value operation.

Represents the minimun value of SSID of packet to match. Available value limits from 0 to 31. The default value depends on the certain rule. For user-define rules it is 0xffffffff. The value 0xffffffff represents restoring default value operation.

Represents the maximum value of SSID of packet to match. Available value limits from 1 to 32. The default value depends on the certain rule. For user-define rules it is 0xffffffff. The value 0xffffffff represents restoring default value operation.

Represents the string of SSID of packet to match.

Represents the compare way of the SSID in the sub rule, including include/not include/equal/not equal. Enumeration: 'notequal': 4, 'include': 1, 'notinclude': 2, 'equal': 3.

Represents the case sensitive or not for the SSID match. 'true': Case insensitive. 'false': Case sensitive.

The table defines the signature sub rules which define the user-define match way through pattern of packet.

Each entry contains information of each pattern signature sub rules.

Represents the ID of the pattern sub rule.

The status of this table entry.

Represents the name of the pattern sub rule.

Represents the offset value of packet match.

Represents the mask value of packet match.

Represents the minimun value of match byte. Available value limits from 0 to 65534.

Represents the maximun value of match byte. Available value limits from 1 to 65535.

Represents whether match start from the payload of the data frame.

Represents the bit string of supported countermeasure policy. The specific countermeasure policy is supported if its corresponding bit is set to 1; otherwise its corresponding bit is set to 0. bit3: misconfigured AP bit4: rogue AP bit5: unauthorized station bit6: external AP bit9: misassociation station bit10: potential authorized AP bit11: potential rogue AP bit12: potential external AP bit13: uncategorized AP bit14: uncategorized station

The table defines the parameters for WIPS countermeasure policy. One policy could be assigned to different VSDs.

Each entry contains information of each countermeasure policy.

Represents the name of countermeasure policy.

The status of this table entry.

Represents the bit string of countermeasure policy configuration. The specific countermeasure of device is enabled if its corresponding bit is set to 1; disabled if its corresponding bit is set to 0. bit3: misconfigured AP bit4: rogue AP bit5: unauthorized station bit6: external AP bit9: misassociation station bit10: potential authorized AP bit11: potential rogue AP bit12: potential external AP bit13: uncategorized AP bit14: uncategorized station

Represents whether enable fixed channel scan function.

Represents the precedence of countermeasure for rogue AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for potential rogue AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for misconfigured AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for external AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for potential external AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for uncategorized AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for potential authorized AP. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for misassociated station. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for uncategorized station. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

Represents the precedence of countermeasure for unauthorized station. Available value limits from 0 to 9. Value 0xffffffff represents undo operation.

The table defines the MAC address list of countermeasure device in WIPS countermeasure policy.

Each entry contains information of each MAC address of device.

Represents the MAC address of countermeasure device.

The status of this table entry.

Represents the bit string of supported malformed packet detect policy controlling the log function. The specific malformed packet detect policy is supported if its corresponding bit is set to 1; otherwise its corresponding bit is set to 0. bit0: invalid IE length bit1: duplicated IE bit2: redundant IE bit3: invalid packet length bit4: illegal IBSS and ESS bit5: invalid source address bit6: overflow EAPOL key length bit7: malformed authetication bit8: malformed association request bit9: malformed HT-IE bit10: large duration bit11: null probe response bit12: invalid deauthentication reason code bit13: invalid disassociation reason code bit14: overflow SSID length bit15: fata-jack bit17: invalid-channel

Represents the bit string of supported malformed packet detect policy controlling the trap function. The specific malformed packet detect policy is supported if its corresponding bit is set to 1; otherwise its corresponding bit is set to 0. bit0: invalid IE length bit1: duplicated IE bit2: redundant IE bit3: invalid packet length bit4: illegal IBSS and ESS bit5: invalid source address bit6: overflow EAPOL key length bit7: malformed authetication bit8: malformed association request bit9: malformed HT-IE bit10: large duration bit11: null probe response bit12: invalid deauthentication reason code bit13: invalid disassociation reason code bit14: overflow SSID length bit15: fata-jack bit17: invalid-channel

Represents.

Represents.

Represents the name of malformed packet detect policy.

The status of this table entry.

Represents the bit string of malformed packet detect policy controlling the log function configuration. The specific malformed packet detect is enbled if its corresponding bit is set to 1; disabled its corresponding bit is set to 0. bit0: invalid IE length bit1: duplicated IE bit2: redundant IE bit3: invalid packet length bit4: illegal IBSS and ESS bit5: invalid source address bit6: overflow EAPOL key length bit7: malformed authetication bit8: malformed association request bit9: malformed HT-IE bit10: large duration bit11: null probe response bit12: invalid deauthentication reason code bit13: invalid disassociation reason code bit14: overflow SSID length bit15: fata-jack bit17: invalid-channel

Represents the bit string of malformed packet detect policy controlling the trap function configuration. The specific malformed packet detect is enbled if its corresponding bit is set to 1; disabled its corresponding bit is set to 0. bit0: invalid IE length bit1: duplicated IE bit2: redundant IE bit3: invalid packet length bit4: illegal IBSS and ESS bit5: invalid source address bit6: overflow EAPOL key length bit7: malformed authetication bit8: malformed association request bit9: malformed HT-IE bit10: large duration bit11: null probe response bit12: invalid deauthentication reason code bit13: invalid disassociation reason code bit14: overflow SSID length bit15: fata-jack bit17: invalid-channel

Represents the threshold of duration for large duration malformed packet detection.

Represents the quiet time after reporting event alarm.

The table provides the OUI list of devices in the static trust list. WIPS will take the devices in the list as authorized devices.

Each entry contains information of each OUI in the static trust list.

Represents the OUI in static trust list.

The status of this table entry.

The table provides the vendor list of devices in the static trust list. WIPS will take the devices in the list as authorized devices.

Each entry contains information of each vendor in the static trust list.

Represents the vendor in static trust list.

The status of this table entry.

The table represents the list of possible BSS information for APs detected by the WIPS.

Each entry contains possible BSS information of each AP detected by WIPS.

Represents the virtual security domain where the BSS was detected.

Represents the Basic Service Set.

Represents the time since AP started to work, which is got from beacon/probe response frame.

Represents the time update hh3cWIPSDctAPRunningTime since system is up.

Represents whether the detected AP is countered by WIPS.

Represents the radio channel which the detected AP work on.

Represents the radio type used by the detected AP.

Represents the authentication method used by the detected AP. none(1) - No key management mode configured, psk(2) - pre-shared key authentication, dot1x(3) - 802.1x authentication, other(4) - other authentication, psk/dot1x(5) - psk and dot1x authentication, psk/other(6) - psk and other authentication, dot1x/other(7) - dot1x and other authentication, psk/dot1x/other(8) - psk, dot1x and other authentication.

Represents the encrypt method used by the detected AP. none(1) - clear text or no cipher method is configure, wep(2) - WEP key, tkip(4) - WPA Temporal Key encryption, ccmp(8) - WPA AES CCMP encryption

Represents the security suites of the detected AP. clear 0x01 wpa2 0x02 wpa 0x04 wep 0x08

Represents the severity level of the detected AP.

Represents the time that AP was detected for the last time since system is up.

Represents the time that AP was detected for the first time since system is up.

Represents whether the AP will be taken as a rogue AP. If the value is true, the MAC address will be automatically added into hh3cWIPSBlockListTable and the category of the AP will be taken as rogue. If the value is false, the MAC address will be automatically deleted from hh3cWIPSBlockListTable.

Represents whether the AP will be taken as an authorized AP. If the value is true, the MAC address will be automatically added into hh3cWIPSTrustListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSTrustListTable

Represents whether the AP will be taken as an ignored AP. If the value is true, the MAC address will be automatically added into hh3cWIPSIgnoreListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSIgnoreListTable

Represents whether the AP will be taken as a countered AP. If the value is true, the MAC address will be automatically added into hh3cWIPSCountermeasureListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSCountermeasureListTable.

Represents the categorized result of the AP. For set operation, only the following values are valid: authorized(2),rogue(3),misconfigured(4),external(5)

Represents by which way the AP is categorized. manual(1) -categorized by user autoByNMS(2) -categorized by NMS(Network Management System) autoByDev(3) -categorized by WIPS

Represents the status of the AP detected by WIPS.

Represents the SSID broadcasted by AP.

Represents the number of clients associated with the detected AP.

Represents the number of sensors detecting the AP.

Represents the vendor of this AP detected by WIPS.

The table represents the list of station associated with APs detected by the WIPS.

Each entry contains possible station information detected by WIPS.

Represents the MAC address of station associated with AP.

The status of this table entry. It is read-only and will return 'Not writable' for set operation.

The table represents the list of sensors.

Each entry contains possible sensor information of WIPS.

Represents the name of sensor.

Represents on which radio the sensor AP detected the AP.

Represents the current value of signal strength that WIPS sensor AP received from the AP.

Represents the time that AP was detected by this sensor for the last time since system is up.

The table represents the list of possible information for stations detected by the WIPS.

Each entry contains possible station information of each station detected by WIPS.

Represents the virtual security domain in which the station was detected.

Represents the MAC address of station.

Represents the BSSID which station associates with.

Represents the status of this station detected by WIPS.

Represents the categorized result of the station.

Represents the radio type used by the detected station.

Represents on which radio channel that WIPS sensor AP detected the station.

Represents whether the detected station is countered by WIPS.

Represents whether the station will be taken as a rogue station. If the value is true, the MAC address will be automatically added into hh3cWIPSBlockListTable and the category of the station will be taken as rogue. If the value is false, the MAC address will be automatically deleted from hh3cWIPSBlockListTable.

Represents whether the station will be taken as an authorized station. If the value is true, the MAC address will be automatically added into hh3cWIPSTrustListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSTrustListTable.

Represents whether the station will be taken as an ignored station. If the value is true, the MAC address will be automatically added into hh3cWIPSIgnoreListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSIgnoreListTable.

Represents whether the station will be taken as a countered station. If the value is true, the MAC address will be automatically added into hh3cWIPSCountermeasureListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSCountermeasureListTable.

Represents the time that station was detected for the first time since system is up.

Represents the time that station was detected for the last time since system is up.

Represents the number of sensors detecting the station.

Represents the authentication state of station with AP. Enumeration: 'eapSuccess': 3, 'eapLogoff': 4, 'authentication': 1, 'deauthentication': 6, 'disassociation': 5, 'association': 2, 'unassociation': 7.

Represents the vendor of this station detected by WIPS.

The table represents the list of sensors detecting the station.

Each entry contains possible sensor information of WIPS.

Represents the name of sensor.

Represents on which radio the sensor AP detected the station.

Represents the current value of signal strength that WIPS sensor AP received from the station.

Represents the time that station was detected by this sensor for the last time since system is up.

The table represents the list of possible ESS information for networks detected by WIPS.

Each entry contains possible ESS information of each ESS detected by WIPS.

Represents the virtual security domain in which the ESS was detected.

Represents the service set identifier for the ESS. Using the ASCII value '1' represents that the SSID is not advertised in the beacon frames.

Represents the encrypt method, security suite and authentication method which are used by the detected ESS. The lowest 8 bits mean encrypt method. The higher 8 bits mean security suite. The third 8 bits stand for authentication method. The higerest 8 bits are reserved. The meaning is shown as follows: 31 23 15 7 0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + | reserved | auth method | security suite|encryptmethod| + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + For encrypt method, the following values are supported: 1: none - clear text or no cipher method is configure, 2: wep - WEP key, 4: tkip - WPA Temporal Key encryption, 8: ccmp - WPA AES CCMP encryption For security suite, the following values are supported: 0x01: clear 0x02: wpa2 0x04: wpa 0x08: wep For authentication method, the following values are supported: 1: none - No key management mode configured, 2: psk - pre-shared key authentication, 3: dot1x - 802.1x authentication, 4: other - other authentication, 5: psk/dot1x - psk and dot1x authentication, 6: psk/other - psk and other authentication, 7: dot1x/other - dot1x and other authentication, 8: psk/dot1x/other - psk, dot1x and other authentication.

Represents the time that ESS was detected for the first time since system is up.

Represents the time that ESS was detected for the last time since system is up.

Represents the status of this ESS detected by WIPS.

Represents whether the ESS broadcasted its SSID.

Represents the number of APs using the same SSID in the ESS.

The table represents the list of APs using the same SSID in the ESS.

Each entry contains possible BSS information of each AP detected by WIPS.

Represents the Basic Service Set.

Represents on which radio channel that WIPS sensor AP detected the BSS.

Represents the number of clients associated with the detected BSS.

The table represents the list of block device MAC address.

Each entry contains block device MAC address information.

Represents the MAC address of block device.

Represents the status of block device. Enumeration: 'dynamic': 2, 'staticAndDynamic': 3, 'static': 1.

The table represents the list of channel information.

Each entry contains channel information.

Represents the channel number.

Represents the radio type used in the specific channel.

Represents whether the channel is permitted.

Represents the latest time that detecting the channel is active.

The table represents the list of global static countermeasure device information.

Each entry contains countermeasure device information.

Represents the MAC address of the countered device.

Represents the channel on which the countermeasure device was working.

Represents the first time that the device was countered since system is up.

Represents the last time that the device was countered since system is up.

Represents how many times that the device was countered.

Represents the number of sensors detecting the device.

The table represents the list of ignored device information.

Each entry contains ignored device information.

Represents the MAC address of the ignored device.

Represents the first time when the event caused by the device was ignored since system is up.

Represents the last time when the event caused by the device was ignored since system is up.

Represents the number of times of the event caused by device has been ignored.

The table represents the list of trust device information.

Each entry contains information of a trust device.

Represents the MAC address of the trust device.

Represents the status of the trust device. Enumeration: 'dynamic': 2, 'staticAndDynamic': 3, 'static': 1.

The table represents the list of channel statistics information.

Each entry contains information of channel statistics.

Represents the MAC address of sensor.

Represents the statistics channel.

Represents the count of total frames in the channel.

Represents the length of total frames in the channel.

Represents the count of broadcast and multicast frames in the channel.

Represents the total length of broadcast and multicast frames in the channel.

Represents the count of unicast frames in the channel.

Represents the total length of unicast frames in the channel.

Represents the count of management frames in the channel.

Represents the count of control frames in the channel.

Represents the count of data frames in the channel.

Represents the count of beacon frames in the channel.

Represents the count of RTS frames in the channel.

Represents the count of CTS frames in the channel.

Represents the count of probe request frames in the channel.

Represents the count of probe response frames in the channel.

Represents the count of fragment frames in the channel.

Represents the count of retry frames in the channel.

Represents the count of EAP-Success frames in the channel.

Represents the count of EAP-Failure frames in the channel.

Represents the count of EAPOL-Start frames in the channel.

Represents the count of EAPOL-Logoff frames in the channel.

Represents the count of association request frames in the channel.

Represents the count of association response frames in the channel.

Represents the count of unicast disassociation frames in the channel.

Represents the count of broadcast disassociation frames in the channel.

Represents the count of authentication frames in the channel.

Represents the count of unicast deauthentication frames in the channel.

Represents the count of broadcast deauthentication frames in the channel.

Represents the count of malformed frames in the channel.

The table represents the list of device statistics information.

Each entry contains information of device statistics.

Represents the MAC address of sensor.

Represents the MAC address of the device detected by the sensor.

Represents the device working channel.

Represents the count of total frames transmitted by the device in one channel.

Represents the length of total frames transmitted by the device in one channel.

Represents the count of broadcast and multicast frames transmitted by the device in one channel.

Represents the length of broadcast and multicast frames transmitted by the device in one channel.

Represents the count of unicast frames transmitted by the device in one channel.

Represents the length of unicast frames transmitted by the device in one channel.

Represents the count of management frames transmitted by the device in one channel.

Represents the count of control frames transmitted by the device in one channel.

Represents the count of data frames transmitted by the device in one channel.

Represents the count of beacon frames transmitted by the device in one channel.

Represents the count of RTS frames transmitted by the device in one channel.

Represents the count of probe request frames transmitted by the device in one channel.

Represents the count of probe response frames transmitted by the device in one channel.

Represents the count of fragment frames transmitted by the device in one channel.

Represents the count of retry frames transmitted by the device in one channel.

Represents the count of association request frames transmitted by the device in one channel.

Represents the count of association response frames transmitted by the device in one channel.

Represents the count of unicast disassociation frames transmitted by the device in one channel.

Represents the count of broadcast disassociation frames transmitted by the device in one channel.

Represents the count of authentication frames transmitted by the device in one channel.

Represents the count of unicast deauthentication frames transmitted by the device in one channel.

Represents the count of broadcast deauthentication frames transmitted by the device in one channel.

Represents the count of EAP-Success frames transmitted by the device in one channel.

Represents the count of EAP-Failure frames transmitted by the device in one channel.

Represents the count of EAPOL-Start frames transmitted by the device in one channel.

Represents the count of EAPOL-Logoff frames transmitted by the device in one channel.

Represents the count of malformed frames transmitted by the device in one channel.

Represents the count of total frames received by the device in one channel.

Represents the length of total frames received by the device in one channel.

Represents the count of unicast frames received by the device in one channel.

Represents the length of unicast frames received by the device in one channel.

Represents the count of management frames received by the device in one channel.

Represents the count of control frames received by the device in one channel.

Represents the count of data frames received by the device in one channel.

Represents the count of RTS frames recieved by the device in one channel.

Represents the count of CTS frames recieved by the device in one channel.

Represents the count of probe request frames received by the device in one channel.

Represents the count of probe response frames received by the device in one channel.

Represents the count of fragment frames received by the device in one channel.

Represents the count of retry frames received by the device in one channel.

Represents the count of association request frames received by the device in one channel.

Represents the count of association response frames received by the device in one channel.

Represents the count of disassociation frames received by the device in one channel.

Represents the count of authentication frames received by the device in one channel.

Represents the count of deauthentication frames received by the device in one channel.

Represents the count of EAP-Success frames received by the device in one channel.

Represents the count of EAP-Failure frames received by the device in one channel.

Represents the count of EAPOL-Start frames received by the device in one channel.

Represents the count of EAPOL-Logoff frames received by the device in one channel.

Represents the count of malformed frames received by the device in one channel.

The table represents the list of device information in static and dynamic countermeasure list.

Each entry contains information of countermeasure device.

Represents the VSD which the device belongs to.

Represents the MAC address of countermeasure device.

Represents the type of countermeasure device. Enumeration: 'dynamic': 2, 'staticAnddynamic': 3, 'static': 1.

Represents the state of countermeasure device. Enumeration: 'action': 3, 'none': 0, 'idle': 1, 'pending': 2.

Represents the time when start to counter on the device.

Represents the category of the device.

Represents the channel on which the device is countered.

Represents the precedence of the device.

The table represents the list of malformed packet statistics information.

Each entry contains information of malformed pakcet.

Represents the name of sensor.

Represents the count of the invalid IE length malformed packets.

Represents the count of the duplicated IE malformed packets.

Represents the count of the redundant IE malformed packets.

Represents the count of the invalide packet length malformed packets.

Represents the count of the illegal bits of representing IBSS and ESS malformed packets.

Represents the count of invalid source address combination malformed pakcets.

Represents the count of the overflow EAPOL key malformed packets.

Represents the count of the malformed authentication packets.

Represents the count of the malformed association request packets.

Represents the count of the malformed High Throughput IE segment packets.

Represents the count of the malformed large duration packets.

Represents the count of the malformed null probe response packets.

Represents the count of the malformed invalid deauthentication reason code packets.

Represents the count of the malformed invalid disassociation reason code packets.

Represents the count of the malformed SSID length overflow packets.

Represents the count of FATA-Jack attack pakcets.

Represents the count of Invalid-Channel attack pakcets.

The table represents the list of possible information for Unassociated stations detected by the WIPS.

Each entry contains possible station information of each Unassociated station detected by WIPS.

Represents the virtual security domain in which the Unassociated station was detected.

Represents the MAC address of Unassociated station.

Represents the categorized result of the Unassociated station.

Represents the radio type used by the Unassociated station. dot11a 0x01 dot11b 0x02 dot11g 0x04 dot11n 0x08 dot11gn 0x10 dot11an 0x20 dot11ac 0x40

Represents whether the Unassociated station is countered by WIPS.

Represents whether the station will be taken as a rogue station. If the value is true, the MAC address will be automatically added into hh3cWIPSBlockListTable and the category of the station will be taken as rogue. If the value is false, the MAC address will be automatically deleted from hh3cWIPSBlockListTable.

Represents whether the station will be taken as an authorized station. If the value is true, the MAC address will be automatically added into hh3cWIPSTrustListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSTrustListTable.

Represents whether the station will be taken as an ignored station. If the value is true, the MAC address will be automatically added into hh3cWIPSIgnoreListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSIgnoreListTable.

Represents whether the station will be taken as a countered station. If the value is true, the MAC address will be automatically added into hh3cWIPSCountermeasureListTable. If the value is false, the MAC address will be automatically deleted from hh3cWIPSCountermeasureListTable.

Represents the time that station was detected for the first time since system is up.

Represents the time that station was detected for the last time since system is up.

Represents the number of sensors detecting the Unassociated station.

Represents the authentication state of Unassociated station with AP. Enumeration: 'eapSuccess': 3, 'eapLogoff': 4, 'authentication': 1, 'deauthentication': 6, 'disassociation': 5, 'association': 2, 'unassociation': 7.

Represents the vendor of this Unassociated station detected by WIPS.

The table represents the list of sensors detecting the Unassociated station.

Each entry contains possible sensor information of WIPS.

Represents the name of sensor.

Represents on which radio the sensor AP detected the Unassociated station.

Represents the current value of signal strength that WIPS sensor AP received from the Unassociated station.

Represents the time that Unassociated station was detected by this sensor for the last time since system is up.