Users Guide

542 | Wireless Intrusion Prevention Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
Classification Methodology
A discovered AP is classified as a rogue or a suspected rogue by the following methods:
 Internal heuristics
 AP classification rules
 Manually by the user
The internal heuristics works by checking if the discovered AP is communicating with a wired device on the
customer network. This is done by matching the MAC address of devices that are on the discovered AP’s network
with that of the user’s wired network. The MAC of the device on the discovered AP’s network is known as the
Match MAC. The ways in which the matching of wired MACs occurs is detailed in the sections Match Methods
and Match Types.
Match Methods
The match methods are:
 Plus One—The match MAC matches a device whose MAC address’ last bit was one more than that of the
Match MAC.
 Minus One—The match MAC matches a device whose MAC address’ last bit was one less than that of the
Match MAC.
 Equal—The match was against the same MAC address.
 OUI—The match was against the manufacturer’s OUI of the wired device.
The classification details are available in the ‘Discovered AP table’ section of the ‘Security Summary’ page of the
WebUI. The information can be obtained by clicking on the details icon for a selected discovered AP. The
information is also available in the command show wms rogue-ap.
Match Types
 Eth-Wired-MAC—The MAC addresses of wired devices learned by an AP on its Ethernet interface.
 GW-Wired-MAC—The collection of Gateway MACs of all APs across the master and local controllers.
 AP-Wired-MAC—The MAC addresses of wired devices learned by monitoring traffic out of other valid and
rogue APs.
 Config-Wired-MAC—The MAC addresses that are configured by the user typically that of well known servers
in the network.
 Manual—User triggered classification.
 External-Wired-MAC—The MAC address matched a set of known wired devices that are maintained in an
external database.
 Mobility-Manager—The classification was determined by the mobility manager, AMP.
 Classification-off—AP is classified as rogue because classification has been disabled causing all non-
authorized APs to be classified as a rogue.
Table 106 Client Classification Definitions
Classification Description
Valid Client Any client that successfully authenticates with a valid AP and passes encrypted traffic is
classified as a valid client.
Manually-contained Client Any clients for which DoS is enabled manually.
Interfering Client A client associated to any AP and is not valid.