Users Guide

205 | Using RAPIDS and Rogue Classification Dell Networking W-AirWave 8.2.4 | User Guide
For additional information about WMS Offload, refer to the Dell Networking W-AirWave 8.2.4 Best Practices Guide
at dell.com/support/manuals.
Device OUI Score
The Organizationally Unique Identifier (OUI) score is based on the LAN MAC address of a device. RAPIDS can be
configured to poll your routers and switches for the bridge forwarding tables. RAPIDS then takes the MAC
addresses from those tables and runs them through a proprietary database to derive the OUI score. The OUI
score of each device is viewable from each rogue’s detail page. Table 102 provides list the OUI scores definitions.
Score Description
Score of 1 Indicates any device on the network; this is the lowest threat level on the network.
Score of 2 Indicates any device in which the OUI belongs to a manufacturer that produces wireless
(802.11) equipment.
Score of 3 Indicates that the OUI matches a block that contains APs from vendors in the Enterprise and
small office/ small home market.
Score of 4 Indicates that the OUI matches a block that belonged to a manufacturer that produces small
office/ small home access points.
Table 102: Device OUI Scores
Rogue Device Threat Level
The threat level classification adds granularity for each general RAPIDS classification. Devices of the same
classification can have differing threat scores based on the classifying rule, ranging from 1 to 10 with a default
value of 5. This classification process can help identify the greater threat. Alerts can be defined and sorted by
threat level.
Threat level and classification are both assigned to a device when a device matches a rule. Once classified, a
device’s classification and threat level change only if it is classified by a new rule or is manually changed. Threats
levels can be manually defined on the RAPIDS > Detail page when the RAPIDS classification is manually
overridden or you can edit the rule to have a higher threat level.
Viewing and Configuring RAPIDS Rules
To view the RAPIDS rules that are currently configured on W-AirWave, navigate to the RAPIDS > Rules page
(Figure 110).