This MIB is intended to be implemented on all
IOS based network entities that provide Wireless
Domain Services, for the purpose of providing network
management stations information about the various
attempts to compromise the security in the 
802.11-based wireless networks.  Entities that can be
configured to provide Wireless Domain Services 
could be an 802.11 Access Point, a Switch or any
other IOS network device, that allows the WDS
configuration.

The MIB reports the information about the MAC
spoofing attempts made by wireless clients to
compromise the security of the network.

MAC Spoofing is detected by the WDS when clients
attempt to authenticate with the WDS using the MAC
address of another client while roaming from one
AP to another.  Upon detecting this, the WDS
provides the information about the client and the
username to the NMS as MIB objects.

The hierarchy of the WDS, AP and MNs is as follows.

+=====+       +=====+          +=====+
|     |       |     |          |     |
| WDS |       | WDS |          | WDS |
|     |       |     |          |     |  
+=====+       +=====+          +=====+  
/  \             \                 \   
/    \             \                 \  
/      \             \                 \
/        \             \                 \
/          \             \                 \
\/          \/            \/                \/
+~-~-~+      +~-~-~+       +~-~-~+           +~-~-~+
+     +      +     +       +     +           +     +
+ AP  +      + AP  +       + AP  +           + AP  +
+     +      +     +       +     +           +     +
+~-~-~+      +~-~-~+       +~-~-~+           +~-~-~+
..            .             .                 .
..            .             .                 .
.  .            .             .                 .
.    .            .             .                 .
.      .            .             .                 .
.        .            .             .                 .
\/        \/           \/            \/                \/
+.....+  +.....+      +-.-.-.+       +~-~-~+          +......+
+     +  +     +      +      +       +     +          +      +
+ MN  +  + MN  +      + MN   +       + MN  +          +  MN  +
+     +  +     +      +      +       +     +          +      +
+.....+  +.....+      +-.-.-.+       +~-~-~+          +......+


The WDS include authentication and registration
services for the APs.  An AP provides Proxy
Authentication and registration services for the
MNs.

The wireless connections are represented as dotted
lines in the above diagram.

                   GLOSSARY

Access Point ( AP )

An entity that contains an 802.11 medium access
control ( MAC ) and physical layer ( PHY ) interface
and provides access to the distribution services via
the wireless medium for associated clients.


Mobile Node ( MN )

A roaming 802.11 wireless device in a wireless
network associated with an access point.


Wireless Domain Services (WDS)

The set of services being offered at a particular
broadcast domain that may be an IP subnet or a
particular VLAN, or across the L3 cloud.  The
services include the following.

1. MN security credential caching to provide
seamless, secure intra-subnet roaming.

2. Authenticated context transfer for roaming
client within the subnet.

Context

The mobility context for an MN includes its current
mobility bindings with the APs, IP/802 address
bindings, cached configuration parameters, QoS state,
IP group membership, authentication state, accounting
statistics, and other dynamically derived protocol
state information.