Wireless Access

last person joined: 9 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

Which wireles client details of rogue/interfering APs can be seen?

This thread has been viewed 0 times

  • 1.  Which wireles client details of rogue/interfering APs can be seen?

    Posted Sep 05, 2012 05:34 AM

    Hello,

     

    I have a client who is examining the IPS/IDS finctionality of the system. He currently has a controller with several AMs. When he goes into the details of clients connected to rogue or interfering AP, he can see only the mac addresses. Is it possible to see what kind of device is that (iPAD, Samsung phone, etc.)?

    If not on controller, will this (or close to it) information be available through the Airwave?

     

    Thanks,

    Yuly

     



  • 2.  RE: Which wireles client details of rogue/interfering APs can be seen?

    EMPLOYEE
    Posted Sep 05, 2012 06:10 AM

    The client's traffic would need to go through the controller for it to be determined what type of client it is.  Since we only have the mac address, at most we could probably tell the manufacturer of the NIC card from the first 3 bytes of the mac address.

     



  • 3.  RE: Which wireles client details of rogue/interfering APs can be seen?

    Posted Sep 05, 2012 06:16 AM

    Thanks, so real fingerprinting works only for true Aruba clients.

    (BTW, why then the manual on Airwave is telling this:

    rogue clients.jpg

    )

    With regards to the manufacturer of the NIC: can someone confirm Airwave will display this (don't haveaccess to the system)?

     

    Thanks again,

    Yuly



  • 4.  RE: Which wireles client details of rogue/interfering APs can be seen?
    Best Answer

    EMPLOYEE
    Posted Sep 05, 2012 06:35 AM

    If that client has been on the Aruba system and then roamed to a rogue device, which is fairly common in a corporate environment, the fingerprint information will be shown.  Otherwise, there will be no fingerprint information.  Notice it says "selecting a linked device", which means that the device has been on the Aruba System and has had the opportunity to be fingerprinted.

     

    Only the manfacturer of the Rogue AP will be seen, NOT the manufacturer of the client device.  I misspoke.