Table 290: Wids Ap Rogue Classification - D-Link DWL-8600AP User Manual

D-Link UWS User Manual
Table 290 shows the information the WIDS AP Rogue Classification page shows for an individual access point.
Field
MAC Address
Status
Test Description
Condition Detected
Reporting MAC
Address
Radio
Test Config
Test Result
Time Since First Report Time stamp indicating how long ago this test first detected the condition.
Time Since Last Report Time stamp indicating how long ago this test last detected the condition.
Command Buttons
• Acknowledge—Clears the rogue status of the AP in the RF Scan database.
• Refresh—Updates the page with the latest information.
D-Link
Oct. 2015

Table 290: WIDS AP Rogue Classification

Description
The Ethernet MAC address of the detected AP. This could be a physical radio
interface or VAP MAC. For D-Link APs this is always a VAP MAC address.
Indicates the managed status of the AP, whether this is a valid AP known to the
switch or a Rogue on the network. The valid values are:
• Managed: The neighbor AP is managed by the wireless system.
• Standalone: The AP is managed in standalone mode and configured as a valid AP
entry (local or RADIUS).
• Rogue: The AP is classified as a threat by one of the threat detection algorithms.
• Unknown: The AP is detected in the network but is not classified as a threat by
the threat detection algorithms.
Identifies the tests that were performed, which includes the following:
• Administrator-configured rogue AP
• Managed SSID received form an unknown AP
• Managed SSID from a fake managed AP
• Managed SSID received from an AP without an SSID
• Beacon Received from a fake managed AP on a invalid channel
• Managed SSID detected with incorrect security configuration
• Invalid SSID received from managed AP.
• AP is operating on an illegal channel
• Standalone AP is operating with unexpected configuration.
• Unexpected WDS device is detected on the network.
• Unmanaged AP detected on wired network.
For more information about these tests, see
Indicates whether the result of the test was true or false.
Identifies the MAC address of the AP that reported the test results.
Identifies which physical radio on the reporting AP was responsible for the test
results.
Shows whether this test is configured to report rogues. Each test can be globally
enabled or disabled to report a positive result as a rogue.
Shows whether this test reported the device as rogue. In some cases the test may
report a positive result, be enabled, but not report the device as rogue because the
device is allowed to operate in this mode.
Monitoring Status and Statistics
Table 362 on page 632
Unified Wired and Wireless Access System
Page 495