Specifications

Monitoring Active User Connections
BlueSecure™ Controller Setup and Administration Guide 15-7
Sensor IP or Sensor Location columns are visible, the column headers also have a global
expansion button (a plus icon). Clicking on this icon expands all sensor mac columns.
• Action - Click the pencil icon to display the Create a New Station page. Click the
green light icon to initiate active containment on the corresponding device. Click
the lock icon to stop active containment on the corresponding device. See
“Configuring Autocontainment” on page 13-6 for information about configuring
active containment on the BSC.
• Name - Name of WLAN vulnerability responsible for alarm. See Table 13-1 in
“Configuring RF Alarms” on page 13-3 for a description of BAPS Sensor alarms.
• Severity - The configured severity level for the alarm:
- Severe - This is the highest alert level and is usually associated with a WLAN
intrusion, e.g., a broadcast attack.
- Warning - This alert level is usually associated with a security vulnerability, e.g.,
a client association change.
- Informational - This alert level is usually associated with a change in network
operational status, e.g., an authorized AP is down.
• Location - The location of the sensor detecting the alarm. This is the same location
specified in the Edit AP dialog.
• First Seen- The date and time the alarm was first received.
• Last Seen - The date and time the alarm was most recently received (this column not
displayed by default).
• Device - MAC address of RF device associated with alarm.
• Sensor IP/MAC - IP address or MAC address of BAPS Sensor that issued the alarm.
• Contain Status - Device containment status, 1—contained or 0—not contained.
Click on a column heading to sort the list of received alarms. Click to
acknowledge the selected alarm(s), click to unacknowledge the selected
alarm(s), and to delete the selected alarm(s).
Monitoring Devices in RF Autocontainment
Click the Status tab in the BSC administrator console, click the Active Connections tab,
and then click the Contained Devices link to list the rogue wireless devices that are in
active containment by the BSC or that were previously in containment. The Contained
Devices page appears as shown in Figure 15-5:
The following information is provided about contained devices:
• Action - Click the key icon to initiate active containment on the corresponding
device. Click the lock icon to stop active containment on the corresponding
device. See “Configuring Autocontainment” on page 13-6 for information about
configuring active containment on the BSC.
• Device MAC - MAC address of contained RF device.
• Sensor MAC - MAC address of BAPS Sensor that detected the rogue device.
• Containment Start Time - The date and time the BSC began to contain the device.
• Duration - Period of time device was in RF containment.
Click Unblock all Contained devices to purge the entire list of contained devices.
Monitoring User Connections Graphically
The BSC administrator console provides a graphical monitoring tool that enables you to
track user activity on the BSC graphically.