Users Guide

211 | Using RAPIDS and Rogue Classification Dell Networking W-AirWave 8.2.4 | User Guide
Column Description
WMS Classification
Date
The date that WMS set the classification.
Confidence The confidence level of the suspected rogue. How confidence is calculated varies based
on the version of ArubaOS. When an ArubaOS controller sees evidence that a device
might be on the wire, it will up the confidence level. If ArubaOS is completely certain that
it is on the wire, it gets classified as a rogue.
Wired Displays whether the rogue device has been discovered on one of your wired networks
by polling routers/switches, your SNMP/HTTP scans, or Dell WIP information. This
column displays Yes or is blank if wired information was not detected.
Detecting APs Displays the number of AP devices that have wirelessly detected the rogue device. A
designation of heard implies the device was heard over the air.
Location If the rogue has been placed in VisualRF, this column will display the name of the floor
plan the rogue is on as a link to the VisualRF Floor Plan View page.
SSID Displays the most recent SSID that was heard from the rogue device.
Signal Displays the strongest signal strength detected for the rogue device.
RSSI Displays Received Signal Strength Indication (RSSI) designation, a measure of the power
present in a received radio signal.
Network Type Displays the type of network in which the rogue is present, for example:
l Ad-hoc—This type of network usually indicates that the rogue is a laptop that
attempts to create a network with neighboring laptops, and is less likely to be a
threat.
l AP—This type of network usually indicates an infrastructure network, for example.
This may be more of a threat.
l Unknown—The network type is not known.
Encryption Type Displays the encryption that is used by the device. Possible contents of this field include
the following encryption types:
l Open—No encryption
l WEP—Wired Equivalent Privacy
l WPA—Wi-Fi Protected Access
Generally, this field alone does not provide enough information to determine if a device
is a rogue, but it is a useful attribute. If a rogue is not running any encryption method,
you have a wider security hole than with an AP that is using encryption.
Ch Indicates the most recent RF channel on which the rogue was detected.
NOTE: It can be detected on more than one channel if it contains more than one radio.
LAN MAC Address The LAN MAC address of the rogue device.
LAN Vendor Indicates the LAN vendor of the rogue device, when known.
Radio MAC
Address
Displays the MAC address for the radio device, when known.
Radio Vendor Indicates the radio vendor of the rogue device, when known.
Table 105: RAPIDS > List Column Definitions (Continued)