Dell PowerConnect W-AirWave 7.6 User Manual page 189

To create a new rule, select the Add button next to New RAPIDS Classification Rule to launch the RAPIDS
Classification Rule page (see
Figure 120:
Classification Rule Page
Fill in the settings described in
Table 99 defines the drop down menu options that are at the bottom left of the RAPIDS Classification Rule dialog
box (see Figure 120). After all rule settings are defined, select Add. The new rule automatically appears in the
RAPIDS > Rules page.
Table 99:
Properties Drop Down Menu
Option
Wireless Properties
Detected on WLAN
Detecting AP Count
Encryption
Network type
Signal Strength
SSID
Detected Client Count
Wireline Properties
Detected on LAN
Fingerprint Scan
IP Address
OUI Score
Dell PowerConnect W-AirWave 7.6 | User Guide
Figure 120).
Table 98 then select an option from the drop down menu.
Description
Classifies based on how the rogue is detected on the wireless LAN.
Classifies based on the number of managed devices that can hear the rogue. Enter a numeric
value and select At Least or At Most.
Classifies based on the rogue matching a specified encryption method. Note that you can select
no encryption with a rule that says Encryption does not match WEP or better.
Rogue is running on the selected network type, either Ad-hoc or Infrastructure.
Rogue matches signal strength parameters. Specify a minimum and maximum value in dBm.
Classifies the rogue when it matches or does not match the specified string for the SSID or a
specified regular expression.
NOTE: For SSID matching functions, AirWave processes only alpha-numeric characters and the
*
asterisk wildcard character ( ). AirWave ignores all other non-alpha-numeric characters. For
example, the string of ethersphere-* matches the SSID of ethersphere-wpa2 but also
the SSID of ethersphere_this_is_an_example (without any dashes).
Classifies based on the number of valid clients.
Rogue is detected on the wired network. Select Yes or No.
Rogue matches fingerprint parameters.
Rogue matches a specified IP address or subnet. Enter IP address or subnet information as
explained by the fields.
Rogue matches manufacturer OUI criteria. You can specify minimum and maximum OUI score
settings from two drop-down lists. Select remove to remove one or both criteria, as desired.
Using RAPIDS and Rogue Classification | 177