3Com WXR100 3CRWXR10095A, WX4400 3CRWX440095A, WX1200 3CRWX120695A manual Rogue Classification

568CHAPTER 26: ROGUE DETECTION AND COUNTERMEASURES

Rogue Classification

When MSS detects a third-party wireless device that is not allowed on the network, MSS classifies the device as one of the following:

„Rogue—The device is in the 3Com network but does not belong there.

„Interfering device—The device is not part of the 3Com network but also is not a rogue. No client connected to the device has been detected communicating with any network entity listed in the forwarding database (FDB) of any WX switch in the Mobility Domain. Although the interfering device is not connected to your network, the device might be causing RF interference with MAP radios.

When you enable countermeasures, you can specify whether to issue them against rogues and interfering devices, or against rogues only. For example, if you do not want to issue countermeasures against your neighbor’s wireless devices, you can select to issue countermeasures against rogues only. RF Auto-Tuning can automatically change MAP radio channels to work around interfering devices without attacking those devices.

In addition, you can optionally configure MSS to issue on-demandcountermeasures. On-demand countermeasures are those launched against devices that you have manually specified in the WX switch’s attack list. When you enable on-demand countermeasures, MSS issues them only against the devices that have been manually specified in the attack list, not to other devices determined to be rogues for other reasons, such as policy violations.

When MSS directs a MAP radio to issue countermeasures against a rogue, MSS changes the channel on the radio to the channel on which the rogue traffic is detected. The radio remains on that channel as long as the radio is issuing countermeasures against the rogue, even if RF Auto-Tuning is enabled.