Sniffer® Portable Professional User's Guide - NetScout

Chapter 4
62 Sniffer Portable Professional
Rogue Identification in Sniffer Portable Professional Displays
Rogues are identified in Sniffer Portable Professional displays as follows:
The Expert generates Rogue Access Point and Rogue Mobile
Unit alarms when a rogue is detected.
The Expert identifies rogues by adding the word (Rogue) in
parentheses following the offending stations’ entries in Summary
and Detail displays. This provides you with a handy means of
identifying units on the wireless network of which you were not
aware, some of which may be unauthorized intruders.
When Rogue Lookup is enabled, the Host Table includes a Status
column in tabular 802.11 displays listing the current
Rogue/Known/Neighbor identification of each listed entity. You
can check an entry’s selection box in the Host Table (in the #
column) and right-click to identify it as either Known or Neighbor,
or to remove it from the Known/Neighbor list entirely.
The Rogue Dialog Box and Expert Options
The Tools > Wireless > Rogue dialog box provides access to the same
settings found in the Tools > Expert Options > 802.11 Options tab.
These two dialogs share the same list of Known/Neighbor wireless
entities – when you change a setting in one dialog box, it is reflected in
both places. For example, if you add an Access Point as Known from the
Host Table, it will appear as Known in both the Tools > Wireless >
Rogue dialog box and the Tools > Expert Options > 802.11 Options
tab.
See Expert 802.11 Options on page 140 for information on using the
options found there, including the Import/Export features not available
in the Tools > Wireless > Rogue dialog box.
Adding Known Addresses to the List
To use the rogue identification abilities of Sniffer Portable Professional
effectively, you must first add the MAC addresses of the known access
points and mobile units on your network to the Expert’s list of known
wireless unit addresses. There are several ways to do this:
Automatically from the real-time Host Table. See Adding Known
Addresses from the Host Table on page 141.
Automatically from the Expert tab of the postcapture display. See
Adding Known Addresses from the Postcapture Display on page
143.
Automatically from the Address Book. See Autodiscovering and
Adding Addresses from the Address Book on page 145.