732 Rogue detection and counter measures
NN47250-500 (Version 03.01)

Displaying SSID or BSSID information for a Mobility Domain

To display SSID or BSSID information for an entire Mobility Domain, use the following command on the seed switch:
show rfdetect mobility-domain [ssid ssid-name | bssid mac-addr]
The following command displays summary information for all SSIDs and BSSIDs detected in the Mobility Domain:
WSS# show rfdetect mobility-domain
Total number of entries: 194
Flags: i = infrastructure, a = ad-hoc, u = unresolved
c = CCMP, t = TKIP, 1 = 104-bit WEP, 4 = 40-bit WEP, w = WEP(non-WPA)
BSSID Vendo Type Flag SSID
------------------- ---------------- -----------------------------------
00:07:50:d5:cc:91 Cisco intfr i----w r27-cisco 1200-2
00:07:50:d5:dc:78 Cisco intfr i----w r116-cisco1200-2
00:09:b7:7b:8a:54 Cisco intfr i-----
00:0a:5e:4b:4a:c0 3Com intfr i----- public
00:0a:5e:4b:4a:c2 3Com intfr i----w Nortelwlan
00:0a:5e:4b:4a:c4 3Com intfr ic---- nrtl-ccmp
00:0a:5e:4b:4a:c6 3Com intfr i----w nrtl-tkip
00:0a:5e:4b:4a:c8 3Com intfr i----w nrtl-voip
00:0a:5e:4b:4a:ca 3Com intfr i----- nrtl-web-based aaa
...
The lines in this display are compiled from data from multiple listeners (AP radios). If an item has the value unresolved,
not all listeners agree on the value for that item. Generally, an unresolved state occurs only when an AP or a Mobility
Domain is still coming up, and lasts only briefly.
The following command displays detailed information for rogues using SSID nrtl-web-based aaa.
WSS# show rfdetect mobility-domain ssid nrtl-web-based aaa
BSSID: 00:0a:5e:4b:4a:ca Vendor: 3Com SSID: nrtl-web-based aaa
Type: intfr Adhoc: no Crypto-types: clear
WSS-IPaddress: 10.8.121.102 Port/Radio/Ch: 3/1/11 Mac: 00:0b:0e:00:0a:6a
Device-type: interfering Adhoc: no Crypto-t ypes: clear
RSSI: -85 SSID: nrtl-web-based aaa
BSSID: 00:0b:0e:00:7a:8a Vendor: Nortel SSID: nrtl-web-based aaa
Type: intfr Adhoc: no Crypto-types: clear
WSS-IPaddress: 10.8.121.102 Port/Radio/Ch: 3/1/1 Mac: 00:0b:0e:00:0a: 6a
Device-type: interfering Adhoc: no Crypto-t ypes: clear
RSSI: -75 SSID: nrtl-web-based aaa
WSS-IPaddress: 10.3.8.103 Port/Radio/Ch: ap 1/1/1 Mac: 00:0b:0e:76:56:82
Device-type: interfering Adhoc: no Crypto-t ypes: clear
RSSI: -76 SSID: nrtl-web-based aaa
Two types of information are shown. The lines that are not indented show the BSSID, vendor, and information about the
SSID. The indented lines that follow this information indicate the listeners (AP radios) that detected the SSID. Each set
of indented lines is for a separate AP listener.