Table 318: Detailed Detected Client Status - D-Link DWS-4026 User Manual

D-Link Unified Access System
Field
MAC Address
Client Status
Authentication Status
Threat Detection
Threat Mitigation Status Indicates whether threat mitigation has been done for this client.
Time Since Entry Last
Updated
Time Since Entry
Create
Client Name
RSSI
Signal
Noise
Probe Req Recorded
Probe Collection
Interval
Highest Probes
Detected
Channel
Auth Msgs Recorded
Auth Collection Interval
Highest Auth Msgs
De-Auth Msgs
Recorded
Page 496 Monitoring and Managing Intrusion Detection

Table 318: Detailed Detected Client Status

Description
The Ethernet address of the client.
Shows the client status, which can be one of the following:
• Authenticated—Client is Authenticated with the system and is not Rogue.
• Detected—Client is detected, not Authenticated, not rogue, and is not found in the Known
Clients Database.
• Known—Client is detected and found in the Known Clients Database, but is not
authenticated.
• Black-Listed—Client tried to associate with the system, but was rejected due to MAC
authentication.
• Rogue—Client failed of the enabled threat tests.
Indicates whether this client is authenticated.
Note: The Client Status can be Rogue, but the authentication status can still be
Authenticated.
Indicates whether one of the threat detection tests has been triggered for this client. If the test
is disabled, the client will not be marked as a rogue, but you can still investigate why the threat
was triggered.
Shows the amount of time that has passed since any event has been received for this client
that updated the detected client database entry.
Shows the amount of time that has passed since this entry was first added to the detected
clients database.
Shows the name of the client, if available, from the Known Client Database. If the client is not
in the database then the field is blank.
If the client is authenticated with the managed AP, this field displays the last RSSI value
reported by the AP with which the client is authenticated. The RSSI is a percentage from 1–
100%. A value of 0 means the AP is not detected.
Last signal strength reported by the managed AP with which the client is authenticated. The
possible range is –128 to 128 dBm.
Last channel noise reported by the managed AP with which the client is authenticated. The
possible range is –128 to 128 dBm.
Number of probe requests recorded so far during the probe collection interval.
Shows the amount of time spent in each probe collection period. The probe collection helps
the switch decide whether the client is a threat.
Shows the largest number of probes that the switch detected during a probe collection interval.
Identifies the channel that the client is using.
Shows the number of IEEE 802.11 Authentication messages recorded so far during the
authentication collection interval.
Shows the amount of time spent in each authentication collection period. The authentication
collection helps the switch decide whether the client is a threat.
Shows the largest number of authentication messages that the switch detected during an
authentication collection interval.
Shows the number of IEEE 802.11 De-Authentication messages recorded so far during the
deauthentication collection interval.
Software User Manual
Document 34CSFP6XXUWS-SWUM100-D7
12/10/09