702 Rogue detection and counter measures

NN47250-500 (Version 03.01)

Rogue access points and clients

A rogue access point is an access point that is not authorized to operate in a network. Rogue access points and
their clients undermine the security of an enterprise network by potentially allowing unchallenged access to
the network by any wireless user or client in the physical vicinity. Rogue access points and users can also
interfere with the operation of your enterprise network.

Rogue classification

When WSS Software detects a third-party wireless device that is not allowed on the network, WSS Software
classifies the device as one of the following:
• AP—an access point on the wireless network
• Client—a wireless client on the network
• Ad hoc—a wireless network established between wireless clients.
• Tag—devices with RFID tags on the network.
• Unknown—unidentified wireless devices on the network.
When you enable countermeasures, you can specify whether to issue them against rogues and interfering
devices, or against rogues only. For example, if you do not want to issue countermeasures against your
neighbor’s wireless devices, you can select to issue countermeasures against rogues only. Auto-RF can auto-
matically change AP radio channels to work around interfering devices without attacking those devices.
In addition, you can optionally configure WSS Software to issue on-demand countermeasures. On-demand
countermeasures are those launched against devices that you have manually specified in the WSS’s attack list.
When you enable on-demand countermeasures, WSS Software issues them only against the devices that have
been manually specified in the attack list, not to other devices determined to be rogues for other reasons, such
as policy violations.
When WSS Software directs an AP radio to issue countermeasures against a rogue, WSS Software changes the
channel on the radio to the channel on which the rogue traffic is detected. The radio remains on that channel as
long as the radio is issuing countermeasures against the rogue, even if Auto-RF is enabled.
To classify devices on the WSS, use the following commands:

WSS-2# set rfdetect classification ssid-masquerade [rogue|skip-test]

WSS-2# set rfdetect classification seen-in- net w ork [rogue|skip-test]

WSS-2# set rfdetect classification ad-hoc [rogue|skip-test]

WSS-2# set rfdetect classification default [rogue|suspect|neighbor]

Selecting skip-test means to skip the test and go to the next test in the list. You can classify RF data based on a
specified criteria and includes the following list:
• masquerade—ssidAn SSID is masquerading as an SSID already on the network.
• seen-in-network—The MAC address is in the forwarding database of the WSS.
• ad-hoc—This device is part of an ad-hoc network.
• default—Set the default classification as a rogue, suspect, or neighbor.