Sniffer® Portable Professional User's Guide - NetScout

Chapter 7
140 Sniffer Portable Professional
and above to be interpreted, at least the connection layer must be
selected.
Expert 802.11 Options
The options in the 802.11 Options tab let you specify how the Expert
identifies rogue entities on the wireless network, as follows:
If the Enable Rogue AP Lookup option (beneath the Known
Address Points in the Network table) is enabled during capture, the
Expert compares the MAC address (not the IP address) of each
detected access point to those in the Known Access Points in the
Network list. If the access point’s MAC address is not in the list,
the Expert labels the address as a “rogue” and generates the
Rogue Access Point alarm.
If the Enable Rogue Mobile Unit option is enabled during
capture, the Expert compares the MAC address (not the IP address)
of each detected mobile unit to those in the Known Mobile Units in
the Network list. the Expert flag mobile units whose MAC addresses
are not in the Known Mobile Units list as “rogues” and generates
the Rogue Mobile Unit alarm.
Additional Rogue Identification
In addition, Sniffer Portable Professional identifies rogues (access points
and workstations) as follows:
The word (Rogue) is included in parentheses following the
offending stations’ entries in Expert Summary and Detail displays.
This provides you with a handy means of identifying units on the
wireless network of which you were not aware, some of which may
be unauthorized intruders.
When Rogue Lookup is enabled, the Host Table includes a Status
column in tabular 802.11 displays listing the current
Rogue/Known/Neighbor identification of each listed entity. You
can check an entry’s selection box in the Host Table (in the #
column) and right-click to identify it as either Known or Neighbor,
or to remove it from the Known/Neighbor list entirely.