Device Oui Score; Rogue Device Threat Level - Dell PowerConnect W-Airwave User Manual

switches feed wireless device information to AirWave, which AirWave then processes. AMP then pushes the
WMS classification to all of the Dell PowerConnect W-Series controllers that are WMS offload enabled.
WMS Offload ensures that a particular BSSID has the same classification on all of the controllers. WMS Offload
removes some load from master controllers and feeds 'connected-to-lan' information to the RAPIDS classification
engine. RAPIDS classifications and controller classifications are separate and often are not synchronized.
NOTE: RAPIDS classification is not pushed to the devices.
The following table compares how default classification may differ between AMP and ArubaOS for scenarios
involving WMS Offload.
Table 98 Rogue Device Classification Matrix
AirWave
Unclassified (default state)
Rogue
Suspected Neighbor
Neighbor
Valid
Contained Rogue
For additional information about WMS Offload, refer to the Dell PowerConnect W-AirWave 7.4Best Practices
Guide in Home > Documentation.

Device OUI Score

The Organizationally Unique Identifier (OUI) score is based on the LAN MAC address of a device. RAPIDS can
be configured to poll your routers and switches for the bridge forwarding tables. RAPIDS then takes the MAC
addresses from those tables and runs them through a proprietary database to derive the OUI score. The OUI score
of each device is viewable from each rogue's detail page.
Table 99 Device OUI Scores
Score
Score of 1
Score of 2
Score of 3
Score of 4

Rogue Device Threat Level

The threat level classification adds granularity for each general RAPIDS classification. Devices of the same
classification can have differing threat scores based on the classifying rule, ranging from 1 to 10 with a default
value of 5. This classification process can help identify the greater threat. Alerts can be defined and sorted by
threat level.
Threat level and classification are both assigned to a device when a device matches a rule. Once classified, a
device's classification and threat level change only if it is classified by a new rule or is manually changed. Threats
Dell PowerConnect W-AirWave 7.4 | User Guide
Description
Indicates any device on the network; this is the lowest threat level on the network.
Indicates any device in which the OUI belongs to a manufacturer that produces wireless (802.11) equipment.
Indicates that the OUI matches a block that contains APs from vendors in the Enterprise and small office/ small
home market.
Indicates that the OUI matches a block that belonged to a manufacturer that produces small office/ small home
access points.
AOS (ARM)
Unknown
Rogue
Interfering
Known Interfering
Valid
DOS
Table 99 provides list the OUI scores definitions.
Using RAPIDS and Rogue Classification | 173