Table of Contents
Advertisement
Sensor IP or Sensor Location columns are visible, the column headers also have a global
expansion button (a plus icon). Clicking on this icon expands all sensor mac columns.
•
Action - Click the pencil icon
green light icon
the lock icon
"Configuring Autocontainment" on page 13-6 for information about configuring
active containment on the BSC.
•
Name - Name of WLAN vulnerability responsible for alarm. See Table 13-1 in
"Configuring RF Alarms" on page 13-3 for a description of BAPS Sensor alarms.
•
Severity - The configured severity level for the alarm:
-
-
-
•
Location - The location of the sensor detecting the alarm. This is the same location
specified in the Edit AP dialog.
•
First Seen- The date and time the alarm was first received.
•
Last Seen - The date and time the alarm was most recently received (this column not
displayed by default).
•
Device - MAC address of RF device associated with alarm.
•
Sensor IP/MAC - IP address or MAC address of BAPS Sensor that issued the alarm.
•
Contain Status - Device containment status, 1—contained or 0—not contained.
Click on a column heading to sort the list of received alarms. Click
acknowledge the selected alarm(s), click
alarm(s), and
Monitoring Devices in RF Autocontainment
Click the Status tab in the BSC administrator console, click the Active Connections tab,
and then click the Contained Devices link to list the rogue wireless devices that are in
active containment by the BSC or that were previously in containment. The Contained
Devices page appears as shown in Figure 15-5:
The following information is provided about contained devices:
•
Action - Click the key icon
device. Click the lock icon
device. See "Configuring Autocontainment" on page 13-6 for information about
configuring active containment on the BSC.
•
Device MAC - MAC address of contained RF device.
•
Sensor MAC - MAC address of BAPS Sensor that detected the rogue device.
•
Containment Start Time - The date and time the BSC began to contain the device.
•
Duration - Period of time device was in RF containment.
Click Unblock all Contained devices to purge the entire list of contained devices.
Monitoring User Connections Graphically
The BSC administrator console provides a graphical monitoring tool that enables you to
track user activity on the BSC graphically.
BlueSecure™ Controller Setup and Administration Guide
to initiate active containment on the corresponding device. Click
to stop active containment on the corresponding device. See
Severe - This is the highest alert level and is usually associated with a WLAN
intrusion, e.g., a broadcast attack.
Warning - This alert level is usually associated with a security vulnerability, e.g.,
a client association change.
Informational - This alert level is usually associated with a change in network
operational status, e.g., an authorized AP is down.
to delete the selected alarm(s).
Monitoring Active User Connections
to display the Create a New Station page. Click the
to unacknowledge the selected
to initiate active containment on the corresponding
to stop active containment on the corresponding
to
15-7
Advertisement
Table of Contents
