Figure 365: Wids Ap Configuration; Table 340: Wids Ap Configuration - D-Link DWS-4026 User Manual

Software User Manual
12/10/09
Although operational mode radios can detect most threats, the sentry radios detect the threats faster, especially when a
potential rogue is operating on a different channel from any of the managed AP radios. The number of deployed sentry radios
should be sufficient to provide coverage by one sentry radio in every geographical location within the network. A denser
sentry deployment may be desirable in order to improve rogue or interferer signal triangulation.
Table 340 shows the fields on the WIDS Security AP Configuration page.
Field
Administrator configured rogue AP
Managed SSID from an unknown AP
Managed SSID from a fake managed
AP
Document 34CSFP6XXUWS-SWUM100-D7

Figure 365: WIDS AP Configuration

Table 340: WIDS AP Configuration

Description
If the source MAC address is in the valid-AP database on the switch or on the
RADIUS server and the AP type is marked as Rogue , then the AP state is
Rogue.
This test checks whether an unknown AP is using the managed network
SSID. A hacker may set up an AP with managed SSID to fool users into
associating with the AP and revealing password and other secure information.
Administrators with large networks who are using multiple clusters should
either use different network names in each cluster or disable this test.
Otherwise, if an AP in the first cluster detects APs in the second cluster
transmitting the same SSID as APs in the first cluster then these APs are
reported as rogues.
A hacker may set up an AP with the same MAC address as one of the
managed APs and configure it to send one of the managed SSIDs. This test
checks for a vendor field in the beacons which is always transmitted by
managed APs. If the vendor field is not present, then the AP is identified as a
fake AP.
D-Link Unified Access System
Configuring Advanced Settings Page 525