Wireless Access

Occasional Contributor II

Rogue AP Detection - CLI & SYSLog

We have syslog -> email funcationity setup, so each time the Aruba AP spots it as rogue, we get an email sent to us.

We are getting lots of emails from the first 2 APs.

And the occasional one from the 3rd one.

(dcca-wc01) #show ap arm neighbors ap-name nlo-ap_00:24:6c:c9:71:d6

              bssid              essid                  channel  rssi  tx-power  PL (dB)  AP Flags  Last Update (Total updates)

              -----              -----                  -------  ----  --------  -------  --------  ---------------------------

              2c:b0:5d:25:30:ba  00:24:6c:17:1f:c0      6        2     0         191      Indirect  2013-06-18 13:04:54


(dcca-wc01) #show ap arm neighbors ap-name nlo-ap_00:24:6c:c9:71:e2

              2c:b0:5d:25:30:b9  00:24:6c:17:20:68      44       34    0         0        Indirect  2013-05-22 11:29:45


(dcca-wc01) #show ap arm neighbors ap-name nlo-ap_00:24:6c:c9:72:28

              2c:b0:5d:25:30:ba  NETGEAR                6        1     0         0        Passive  


My first question is, how do we interpret the below above? Tried to look in the 6.2 Aruba CLI ref guide, but I guess the documentation is out of date, as it doenst show me what all the columns in the above mean, and how to interpret them. See screenshot from the manual below. This is all it has!


Following questions about the above really

  1. Whats indirect and passive mean in the flags?
  2. Seems odd that we are getting so many emails from the second AP, but the last update column shows last month?!  Also, by channel 44 I assume its talking about the A-band? In which case how do I get the G-band info
  3. How do I tel which AP is closer? Which of the above APs “hears” the rogue the loudest? Is it RSSI ?  and which number is closer? 
Guru Elite

Re: Rogue AP Detection - CLI & SYSLog

Please open a support case so that you get detailed answers to your questions.


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Search Airheads
Showing results for 
Search instead for 
Did you mean: