Forum

Custom IDS Signatures on Cisco WLCs

1 posts by 1 authors in: Forums > CWDP & CWAP - Enterprise Wi-Fi Design & Analysis
Last Post: March 28, 2011:

By emszurek March 28, 2011

Reply

Has anyone attempted to modify or create original signatures for the IDS feature in the Cisco Wireless LAN Controllers? I was able to find an [url=http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008063e5d0.shtml]old (read: ancient) guide[/url] from 3.2 and looking at the signatures in 7.x it does appear too much has changed.

My goal here is to understand the process by which this feature actually works. Does this look into only the 802.11 frame or could it be used to inspect deeper (deny based on destination TCP/UDP port, IP information, etc)? Is the offset really in decimal and the mask/pattern in hex?

Anyone care to have messed with this before?

Page 1 of 1

1

Success Stories

I literally just came out of the testing centre having taken the CWDP exam. The certification process opened my mind to different techniques and solutions. This knowledge can only broaden your perspective. Great job, CWNP, you have a great thing going on here.
-Darren

Working through the CWNP coursework and certifications helped not only to deepen my technical knowledge and understanding, but also it boosted my confidence. The hard work it took to earn my CWNE has been rewarding in so many ways.
-Ben

I want to commend you and all at CWNP for having a great organization. You really 'raise the bar' on knowing Wi-Fi well. I have learned a ton of information that is helping my job experience and personal career goals, because of my CWAP/CWDP/CWSP studies. Kudos to all at CWNP.
-Glenn