CISCO-DOT11-WIDS-MIB Table View

This table gives the statistics on the EAPOL flood
attacks observed at this radio interface.
          
An entry in this table is created by the agent when
this 802.11 station detects an EAPOL flood attack.
All the columns in the entries except the
cDot11WidsEapolFloodStopTime are populated when
the attack is observed first.  The object
cDot11WidsEapolFloodStopTime is populated when no
flood conditions are observed following the initial
observation at the time indicated by
cDot11WidsEapolFloodStartTime.
          
This can be illustrated by the following example.
          
Assume that the monitoring interval is configured 
to 1 minute through the
cDot11WidsEapolFloodInterval object and the number
of attempts is set to 5.
          
At the end of the first minute after this
configuration is made,  client c1 is found to
have made 4 attempts and another client c2 have
made 3.  Hence, in total, the attempt count
exceeds 7 and the agent adds a new row to this
table.  The cDot11WidsFloodStopTime carries a
value of 0 at this point in the newly added row.
The MIB object cDot11WidsEapolFloodClientMac
at this point holds the MAC address of c1
and cDot11WidsEapolFloodClientCount holds the
value of 4.
          
At the end of the second interval,  assume that
the clients are found to have made only 4
attempts in total with c1 and c2 making 3 and 1
attempt(s) respectively.  Now the total count
is not found to exceed the threshold.  Hence
the flood is observed to be stopped.  The
object cDot11WidsEapolFloodStopTime is now
populated with this time at which the flood is
observed to be stopped.  The MIB object
cDot11WidsEapolFloodClientMac at this point
holds c1's MAC address and 
cDot11WidsEapolFloodClientCount would hold a
value of 7. If the count is found to exceed in
the next interval, it will be treated as a
beginning of a new flood event and hence a new
entry will be created for the same.
          
Assume the case where, at the end of the second
interval, the total count continues at the
rate above the threshold, with c1 making 5 and
c2 making 2 attempts respectively.  Since the
flood is not observed to be stopped,  the
object cDot11WidsFloodStopTime continues to
hold a value of zero.
          
The agent at anytime will retain only the most
recent and maximum number of entries, as given
by cDot11WidsFloodMaxEntriesPerIntf,  for a
particular value of ifIndex.  The older entries
are purged automatically when the number of
entries for a particular ifIndex reaches its
maximum.
          
This table has a expansion dependent relationship
with ifTable defined in IF-MIB.  There exists a
row in this table corresponding to the row for each
interface of iftype ieee80211(71) found in ifTable.
cDot11WidsEapolFloodIndex acts as the
expansion index.

This table gives the information about the
802.11 wireless clients that have been blacklisted
while attempting to get authenticated with this
802.11 station at this radio interface.
          
An entry is added to this table when the number
of consecutive failed authentication attempts
made by a client equals the value configured
through cDot11WidsBlackListThreshold.  The
client will then be blocked from getting
authenticated for a time period equal to the
value configured through
cDot11WidsBlackListDuration.  After this time
elapses, the client is taken off from the list
and the agent automatically removes the entry
corresponding to that client from this table.
          
This table has a expansion dependent relationship on
the ifTable.  For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71).  cDot11BlackListIndex acts as the
expansion index.

This table gives the statistics on the various
protection failures occurred during the data
communication of this 802.11 station with a
particular client currently associated at this
dot11 interface.
          
Note that the agent populates this table with an
entry for an associated client if and only if 
at least one of the error statistics, as reported
by the counter-type objects of this table, has a
non-zero value.
          
This table has a expansion dependent relationship on
the ifTable.  For each entry in this table, there
exists at least an entry in the ifTable of ifType
ieee80211(71).  cDot11WidsSsid and 
cDot11WidsClientMacAddress act as the
expansion indices.