Extreme Networks Summit WM Technical Reference Manual page 30

Rogue Access Point Detection
A client configured in ad-hoc mode has been identified
6 Inactive Wireless AP with known SSID – Major Alarm
A "known" Wireless AP has been detected that the Summit WM Controller has identified as not in
service (stolen?)
7 Inactive Wireless AP with unknown SSID – Major Alarm
A "known" Wireless AP with an unknown SSID has been detected that the Summit WM Controller
has identified as not in service (stolen?)
8 Known AP with Valid SSID Suppress Conflict – Critical Alarm
A "known" Wireless AP with a valid SSID has been detected, however the configured AP is not
broadcasting the SSID value (suppressed). Instead, the rogue device is broadcasting the SSID.
With each event, the following information will be reported:
Scanning Wireless AP Name & Scan Group
●
Detection Date and Time
●
Rogue SSID and Channel
●
Signal Strength (RSSI)
●
Security/Encoding type (for example. WEP, 802.1X, none, and so on)
●
This information is available through SNMP, or by viewing a report displayed in the Summit WM GUI.
In addition, a summary screen is provided as a pop-up window that provides a summary of all
potential problem areas on a single screen.
NOTES: A Few Points Related to Summit WM series Spy and Rogue Systems in General.
Due to the fact that accuracy is suspect, an administrator will more than likely still have to hunt the
●
rogue in person with a handheld/laptop to find the exact location. So, even using just the Summit
WM Controller's Summit WM series Spy information (mentally weigh and plot RSSI values from the
scan group APs) an administrator can locate a rogue just as easily as with graphic tools.
Some other systems address rogue APs with a function known as "containment". The effectiveness
●
of containment may vary due to some inherent limitations of this method. For example, most
containment is done via RF bombardment or via a ping DOS to the rogue device. Unless WLAN
gear uses very directional or phased array antenna systems, the bombardment is not discriminating
and will impact every device (MUs included) in close proximity. Also, if a rogue containment AP is
launching an attack (for containment) the service expectation of the client may be impacted. And
finally, because WiFi works in an UNLICENSED spectrum, a rogue containment system may
inadvertently attack a co-existing, legitimate system operating in an open spectrum.
30
Summit WM Technical Reference Guide, Software Version 5.1