Ruckus Wireless ZoneDirector 1100 User Manual page 292

Detecting Rogue Access Points
Access Point Sensor Information
1 Go to Monitor > Rogue Devices. (You can also click the "#of Rogue Devices"
link from the Devices Overview widget on the Dashboard.)
Figure 154. Rogue devices indicator
2 When the Monitor > Rogue Devices page appears, three tables are listed:
• Currently Active Rogue Devices: Lists all currently detected rogue APs.
• Known/Recognized Rogue Devices: Lists rogue APs that have been marked
as known, typically neighbor APs.
• User Blocked Rogue Devices: Lists devices that have been marked as
malicious by the user.
3 Review the Currently Active Rogue Devices table. The following types of Rogue
APs generate an alarm when ZoneDirector detects them (if the alarm has been
enabled from the Configure > Alarms page):
• AP: A normal rogue AP. This rogue AP has not yet been categorized as
malicious or non-malicious.
• malicious AP (SSID-spoof): A malicious rogue AP that uses the same SSID
as ZoneDirector's AP, also known as an Evil-twin AP.
• malicious AP (MAC-spoof): A malicious rogue AP that has the same BSSID
(MAC) as one of the virtual APs managed by ZoneDirector.
• malicious AP (Same-Network): A malicious rogue AP that is connected to the
same wired network.
• malicious AP (User-Blocked): A rogue AP that has been marked as malicious
by the user.
4 To mark an AP as malicious, click Mark as Malicious. This AP will now be
blocked and listed in the User Blocked Rogue Devices table. The malicious rogue
AP protection mechanism (enabled from the Configure > WIPS > Intrusion
Detection and Prevention page) is automatically applied to all rogue APs
categorized as "malicious", whether user-blocked or another type.
5 If a listed AP is part of another, known neighbor network, click Mark as Known.
This identifies the AP as posing no threat, while copying the record to the Known/
Recognized Rogue Devices table.
292
Ruckus Wireless, Inc.