716 Rogue detection and counter measures
NN47250-500 (Version 03.01)

Using on-demand countermeasures in a Mobility Domain

If you are using on-demand countermeasures in a Mobility Domain, you should enable the feature and synchronize the
attack lists on all the WSSs in the Mobility Domain. This ensures a WSS attacks devices in its attack list, rather than
devices that may be specified in the attack lists of other WSSs in the Mobility Domain, which could produce unexpected
results.
For example, in a Mobility Domain consisting of three WSSs, if WSS A has an attack list consisting of MAC address 1,
and WSS B has an attack list consisting of MAC address 2, then WSS C (the seed for the Mobility Domain) might
determine that the optimal radio to attack MAC address 2 is attached to WSS A.
This would mean that MAC address 2 would be attacked from WSS A, even though MAC address 2 does not reside in
WSS A’s attack list. In addition, if the AP attached to WSS A is busy attacking MAC address 2, then MAC address 1
might not be attacked at all if it comes on the network.
By making the attack lists identical on all of the WSSs in the Mobility Domain when you enable on-demand counter-
measures, it ensures that a WSS always attacks MAC addresses that reside in its attack list. Note that WSSs do not share
attack lists automatically, so you must manually synchronize the attack lists on the WSSs in the Mobility Domain.

Disabling or reenabling Scheduled RF Scanning

When Scheduled RF Scanning is enabled, the AP radios managed by the switch look for rogue devices by sending probe
any frames (probes with a null SSID name), to solicit probe responses from other APs.
Scheduled RF Scanning is enabled by default. You can disable or reenable the feature on an individual radio profile
basis. To disable or reenable Scheduled RF Scanning on a radio profile, use the following command:
set radio-profile name active-scan {enable | disable}
The following command disables Scheduled RF Scanning in radio profile radprof3:
WSS# set radio-profile radprof3 active-scan disable
success: change accepted.

Enabling AP signatures

An AP signature is a set of bits in a management frame sent by an AP that identifies that AP to WSS Software. If
someone attempts to spoof management packets from a Nortel AP, WSS Software can detect the spoof attempt.
AP signatures are disabled by default. To enable or disable them, use the following command:
set rfdetect signature {enable | disable}
The command applies only to APs managed by the WSS on which you enter the command. To enable signatures on all
APs in a Mobility Domain, enter the command on each WSS in the Mobility Domain.
Note. You must use the same AP signature setting (enabled or disabled) on all WSSs in
a Mobility Domain.