Rogue detection and counter measures 705
Nortel WLAN—Security Switch 2300 Series Configuration Guide

RF detection scans

All radios continually scan for other RF transmitters. Radios perform passive scans and active scans:
• Passive scans—The radio listens for beacons and probe responses.
• Active scans—The radio sends probe any requests (probe requests with a null SSID name) to solicit
probe responses from other access points.
Passive scans are always enabled and cannot be disabled. Active scans are enabled by default but can be
disabled on a radio-profile basis.
Radios perform both types of scans on all channels allowed for the country of operation. (This is the regulatory
domain set by the set system countrycode command.) 802.11b/g radios scan in the 2.4 GHz to 2.4835 GHz
spectrum. 802.11a radios scan in the 5.15 GHz to 5.85 GHz spectrum.
Both enabled radios and disabled radios perform these scans.
The active-scan algorithm is sensitive to high-priority (voice or video) traffic or heavy data traffic. Active-scan
scans for 30 msec once every second, unless either of the following conditions is true:
• High-priority traffic (voice or video) is present at 64 Kbps or higher. In this case, active-scan scans for
30 msec every 60 seconds.
• Heavy data traffic is present at 4 Mbps or higher. In this case, active-scan scans for 30 msec every
5 seconds.
On a disabled radio, the radio is dedicated to rogue detection and scans on each channel in round-robin
fashion.
Radio configuration has the ability of separate scanning behaviors independently controlled by separate attri-
butes. For example, a “disabled” radio does not transmit or receive, and a radio that is scanning but not
providing radio service to clients is in “sentry” mode.
In addition, it has the capability to weight scanning time on the radios. By weighting the scanning time, a
higher proportion of time is spent on “operational” channels. This increases the probability that an event of
interest is detected within a short time.
If the AP is in “sentry” mode, the LEDs alternate between green and yellow/amber. If the radio is “disabled”
the LED is a solid yellow/amber color.

Dynamic Frequency Selection (DFS)

Some regulatory domains require conformance to ETSI document EN 301 893. Section 4.6 of that document
specifies requirements for Dynamic Frequency Selection (DFS). These requirements apply to radios operating
in the 5 GHz band (802.11a radios).
In countries where Dynamic Frequency Selection (DFS) is required, WSS Software performs the appropriate
check for radar. If radar is detected on a channel, the AP radio stops performing active scans on that channel in
accordance with DFS. However, the radio continues to passively scan for beacons from rogue devices.