09-30-2013 12:25 PM
I'm doing some tests of IDS features on RAP-3WN ( 126.96.36.199-188.8.131.52_39461 ) working as IAP. I know it's the smallest one, but that's the one I was given on Aruba training. I've tested creating ad-hoc network with the SSID same as one advertised by RAP. I've also tried switching STA between RAP an created ad-hoc network. In WIP > Detection I've got "high" on both infrastructure and client, detect-adhoc-using-valid-ssid is enabled. My assumption is alarm should be generated in such conditions, am I wrong ?
I've manually set same channel channel on RAP and my "malicious" ad-hoc network. RAP even don't report that network in foreign access points list.