ids impersonation-profile

Name that identifies an instance of the profile.

Range:1-63 characters

Default:"default"

Time to wait, in seconds, after detecting AP Spoofing after which the check can be resumed.

Range:60-360000 seconds

Default:60 seconds

Percentage increase, in beacon rates, that triggers an AP impersonation event.

Range:0-100%

Default:50%

Time, in seconds, after the beacon difference threshold is crossed before an AP impersonation event is generated.

Default:3 seconds

Time to wait, in seconds, after detecting a beacon with the wrong channel after which the check can be resumed.

Range:60-360000 seconds

Default:900 seconds

Time to wait, in seconds, after detecting man-in-the-middle attack after which the check can be resumed.

Range:60-360000 seconds

Default:900 seconds

Name of an existing IDS impersonation profile from which parameter values are copied.

Enables or disables detection of AP impersonation. In AP impersonation attacks, the attacker sets up an AP that assumes the BSSID and ESSID of a valid AP or a neighboring AP. AP impersonation attacks can be done for man-in-the-middle attacks, a rogue AP attempting to bypass detection, or a honeypot attack.

Default:enabled

Enables or disables AP Spoofing detection.

Default:enabled

Enables or disables detection of beacons advertising the incorrect channel.

Default:disabled

Enables or disables channe-based man-in-the-middle attack detection.

Default:disabled

Enables or disables detection of the Hotspotter attack to lure away valid clients.

Default:disabled

Time to wait, in seconds, after detecting an attempt to use the Hotspotter tool against clients.

Range:60-360000 seconds

Default:900 seconds

Negates any configured parameter.