Users Guide

Field Default Description
ARP IP Match Timeout (1-
168 hours)
24 If you have routers and switches on W-AirWave, and it's scanning
them for ARP tables, this can assign a rogue IP address
information. This timeout specifies how recent that information
needs to be for the IP address to be considered valid. Note that the
default ARP poll period is long (several hours).
RAPIDS Export Threshold Suspected
Rogue
Exported rogues will be sent to VisualRF for location calculation.
Wired-to-Wireless MAC
Address Correlation (0-8
bits)
4 Discovered BSSIDs and LAN MAC addresses which are within this
bitmask will be combined into one device. 4 requires all but the last
digit match (aa:bb:cc:dd:ee:fX). 8 requires all but the last two digits
match (aa:bb:cc:dd:ee:XX).
Wireless BSSID
Correlation (0-8 bits)
4 Similar BSSIDs will be combined into one device when they fall
within this bitmask. Setting this value too high may result in
identifying two different physical devices as the same rogue.
NOTE: When you change this value, RAPIDS will not immediately
combine (or un-combine) rogue records. Changes will occur during
subsequent processing of discovery events.
Delete Rogues not
detected for (0-30 days,
zero disables):
N/A This value cannot be larger than the rogue discovery event
expiration (30) configured on the AMP Setup page, unless that
value is set to 0.
Automatically OS scan
rogue devices
No Whether to scan the operating system of rogues. Enabling this
feature will cause RAPIDS to perform an OS scan when it gets in IP
address for a rogue device. The OS scan will be run when a rogue
gets an IP address for the first time or if the IP address changes.
Wired-to-Wireless Time
Correlation Window
(minutes, zero disables):
360 Specify a time frame for wired and wireless correlation. RAPIDS
discovery events detected wirelessly and on LAN will only match if
the wireless and LAN discovery events occur during this
timeframe.
Table 97: RAPIDS > Setup > Basic Configuration Fields and Default Values
Classification Options
Field Default Description
Acknowledge Rogues by
Default
No Sets RAPIDS to acknowledge rogue devices upon initial detection,
prior to their classification.
Manually Classifying
Rogues Automatically
Acknowledges them
Yes Defines whether acknowledgment happens automatically whenever a
rogue device receives a manual classification.
Table 98: RAPIDS > Setup > Classification Options Fields and Default Values
Containment Options
Using RAPIDS, W-AirWave can shield rogue devices from associating to Cisco WLC controllers (versions 4.2.114
and later), and Dell Networking W-Series controllers (running ArubaOS versions 3.x and later). W-AirWave will
alert you to the appearance of the rogue device and identify any mismatch between controller configuration and
the desired configuration.
Dell Networking W-AirWave 8.2.4 | User Guide Using RAPIDS and Rogue Classification | 202