Network Management

last person joined: yesterday 

Keep an informative eye on your network with HPE Aruba Networking network management solutions
Back to discussions
Expand all | Collapse all

Airwave Rogue APs SSID Spoofing - can't find the Rogue onsite

This thread has been viewed 1 times

  • 1.  Airwave Rogue APs SSID Spoofing - can't find the Rogue onsite

    Posted Dec 07, 2015 11:47 AM

    We have recently started looking at rogue APs using Airwave.  We have started with two simple rules. The first is to tag it as a rogue if it's detected via wireless and on the wired.  The second one is to tag it as a rogue if it detects any AP broadcasting any of our SSIDs.

     

    With those two rules we are seeing a total of 11 rogues being detected via the SSID spoofing rule.  One actually is right in our working area.  I've used Airmagnet WiFi Analyzer to find the device and there is absolutely nothing in the area.  Has anyone else seen this type of issue of Airwave reporting these types of rogues that don't exist?



  • 2.  RE: Airwave Rogue APs SSID Spoofing - can't find the Rogue onsite

    Posted Dec 07, 2015 01:07 PM

    After doing more research, found that the local controller had a device that Airwave was marking as rogue (SSID Spoofing). The details of it stated that it was down.  I believe this was an old entry and deleted from the local controller.  Deleted all from Airwave and let it find the rogues again.  It didn't report the one that was deleted from the local controller and the local controller is not reporting it again.  I'm wondering why Airwave was reporting it as a rogue and that it was detected via wireless when clearly the device didn't exist.

     

    Is there a command to completely delete all rogue type devices so I can start with a clean slate?



  • 3.  RE: Airwave Rogue APs SSID Spoofing - can't find the Rogue onsite

    Posted Dec 20, 2015 10:23 AM
    @silwi wrote:

    Is there a command to completely delete all rogue type devices so I can start with a clean slate?

    isnt that what you already did?