Sniffer® Portable Professional User's Guide - NetScout

More documents

Recommendations

Info

Chapter 4 62 Sniffer Portable Professional Rogue Identification in Sniffer Portable Professional Displays Rogues are identified in Sniffer Portable Professional displays as follows: The Expert generates Rogue Access Point and Rogue Mobile Unit alarms when a rogue is detected. The Expert identifies rogues by adding the word (Rogue) in parentheses following the offending stations’ entries in Summary and Detail displays. This provides you with a handy means of identifying units on the wireless network of which you were not aware, some of which may be unauthorized intruders. When Rogue Lookup is enabled, the Host Table includes a Status column in tabular 802.11 displays listing the current Rogue/Known/Neighbor identification of each listed entity. You can check an entry’s selection box in the Host Table (in the # column) and right-click to identify it as either Known or Neighbor, or to remove it from the Known/Neighbor list entirely. The Rogue Dialog Box and Expert Options The Tools > Wireless > Rogue dialog box provides access to the same settings found in the Tools > Expert Options > 802.11 Options tab. These two dialogs share the same list of Known/Neighbor wireless entities – when you change a setting in one dialog box, it is reflected in both places. For example, if you add an Access Point as Known from the Host Table, it will appear as Known in both the Tools > Wireless > Rogue dialog box and the Tools > Expert Options > 802.11 Options tab. See Expert 802.11 Options on page 140 for information on using the options found there, including the Import/Export features not available in the Tools > Wireless > Rogue dialog box. Adding Known Addresses to the List To use the rogue identification abilities of Sniffer Portable Professional effectively, you must first add the MAC addresses of the known access points and mobile units on your network to the Expert’s list of known wireless unit addresses. There are several ways to do this: Automatically from the real-time Host Table. See Adding Known Addresses from the Host Table on page 141. Automatically from the Expert tab of the postcapture display. See Adding Known Addresses from the Postcapture Display on page 143. Automatically from the Address Book. See Autodiscovering and Adding Addresses from the Address Book on page 145.
Setting Options in the Sniffer Window Manually from the 802.11 Options tab of the Expert Properties dialog box. See Adding Known Addresses Manually in the 802.11 Options Tab on page 145. In addition, you can also import and export lists of known addresses (for example, you can import addresses from other Sniffer Portable Professional installations). User’s Guide 63
Page 1 and 2:
Sniffer ® Portable Professional Us
Page 3 and 4:
"This product includes software dev
Page 5:
Related Information Resources NetSc
Page 8 and 9:
5 Monitoring Your Network . . . . .
Page 10 and 11:
10 Sniffer Portable Professional
Page 12 and 13: Chapter 1 Product Comparison Table
Page 14 and 15: Chapter 1 Major Components of Sniff
Page 16 and 17: Chapter 1 Table 1-2. Features for W
Page 18 and 19: Chapter 2 System Requirements 18 Sn
Page 20 and 21: Chapter 2 20 Sniffer Portable Profe
Page 22 and 23: Chapter 2 Installing the Sniffer Po
Page 26 and 27: Chapter 2 Native Atheros Driver Upd
Page 30 and 31: Chapter 2 Authorizing Sniffer Porta
Page 32 and 33: Chapter 2 Entering Licensing Inform
Page 34 and 35: Chapter 2 Starting Sniffer Portable
Page 36 and 37: Chapter 2 Tuning Settings for Sniff
Page 42 and 43: Chapter 3 a b c 42 Sniffer Portable
Page 44 and 45: Chapter 3 Sniffer Window Menus 44 S
Page 48 and 49: Chapter 4 Setting the General Tab O
Page 52 and 53: Chapter 4 Setting the App Threshold
Page 54 and 55: Chapter 4 Setting Tools > Wireless
Page 56 and 57: Chapter 4 Configuring Wireless Encr
Page 64 and 65: Chapter 4 Adding Tools to the Tools
Page 68 and 69: Chapter 5 Monitoring Wireless Netwo
Page 70 and 71: Chapter 5 Applying Monitor Filters
Page 72 and 73: Chapter 5 Dashboard 72 Sniffer Port
Page 76 and 77: Chapter 5 The Dashboard Gauge Tab 7
Page 82 and 83: Chapter 5 Host Table 82 Sniffer Por
Page 88 and 89: Chapter 5 Viewing Access Points Onl
Page 92 and 93: Chapter 5 Selecting Wireless Host T
Page 96 and 97: Chapter 5 Setting Capture Filters f
Page 100 and 101: Chapter 5 ART - The Server-Client R
Page 102 and 103: Chapter 5 Show Options 102 Sniffer
Page 104 and 105: Chapter 5 ART Options - Servers Onl
Page 106 and 107: Chapter 5 106 Sniffer Portable Prof
Page 108 and 109: Chapter 5 Adding Custom Protocols t
Page 110 and 111: Chapter 5 History Samples Click to
Page 112 and 113:
Chapter 5 112 Sniffer Portable Prof
Page 114 and 115:
Chapter 5 Protocol Distribution 114
Page 116 and 117:
Chapter 5 Global Statistics 116 Sni
Page 118 and 119:
Page 120 and 121:
Chapter 5 Monitor Alarms 120 Sniffe
Page 122 and 123:
Chapter 6 Capture Controls 122 Snif
Page 124 and 125:
Chapter 6 Capture Buffer 124 Sniffe
Page 126 and 127:
Chapter 6 Tips: 126 Sniffer Portabl
Page 128 and 129:
Chapter 6 Capturing from Specific S
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Chapter 7 Setting Expert Options 13
Page 136 and 137:
Page 138 and 139:
Chapter 7 Expert Subnet Mask Settin
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Chapter 7 Discovered access points
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Chapter 7 Expert Oracle Options 150
Page 152 and 153:
Chapter 7 Limitations of the Expert
Page 154 and 155:
Chapter 7 Click to show the packet
Page 156 and 157:
Page 158 and 159:
Chapter 8 Displaying Captured Packe
Page 160 and 161:
Chapter 8 Postcapture Views for Wir
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Chapter 8 Table 8-3. Decode Tab Too
Page 168 and 169:
Page 170 and 171:
Chapter 8 b 170 Sniffer Portable Pr
Page 172 and 173:
Chapter 8 a 172 Sniffer Portable Pr
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Chapter 8 Display Setup > Summary D
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Chapter 8 Searching for Frames in t
Page 188 and 189:
Chapter 8 Searching for Frames Matc
Page 190 and 191:
Chapter 8 Searching for Frames Matc
Page 192 and 193:
Chapter 8 Searching for Data Patter
Page 194 and 195:
Page 196 and 197:
Chapter 8 Printing Decoded Packets
Page 198 and 199:
Chapter 8 Using Protocol Forcing Yo
Page 200 and 201:
Chapter 8 Sniffer Portable Professi
Page 202 and 203:
Chapter 8 Postcapture Matrix Tab 20
Page 204 and 205:
Chapter 8 More about the Matrix Tra
Page 206 and 207:
Chapter 8 Postcapture Host Table Ta
Page 208 and 209:
Chapter 8 Postcapture Protocol Dist
Page 210 and 211:
Chapter 8 Postcapture Statistics Ta
Page 212 and 213:
Page 214 and 215:
Chapter 9 4 Click OK. 214 Sniffer P
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Chapter 10 220 Sniffer Portable Pro
Page 222 and 223:
Chapter 10 Using a Defined Filter U
Page 224 and 225:
Page 226 and 227:
Chapter 10 Drag and drop a symbolic
Page 228 and 229:
Chapter 10 Setting Filter Options i
Page 230 and 231:
Page 232 and 233:
Chapter 10 Add or Edit Pattern Dial
Page 234 and 235:
Page 236 and 237:
Chapter 10 Specify one or more netw
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Chapter 10 5 Click OK. 246 Sniffer
Page 248 and 249:
Page 250 and 251:
Chapter 11 Description 250 Sniffer
Page 252 and 253:
Chapter 11 Entering Names Manually
Page 254 and 255:
Chapter 11 Click to resolve the Dom
Page 256 and 257:
Page 258 and 259:
Chapter 12 Type of node triggering
Page 260 and 261:
Chapter 12 Setting Alarm Severity L
Page 262 and 263:
Chapter 12 Logging and Severities f
Page 264 and 265:
Chapter 12 Setting Alarm Notificati
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Chapter 13 Creating Sniffer Monitor
Page 272 and 273:
Page 274 and 275:
Capture panel, 123 Capture triggers
Page 276 and 277:
zooming, Host Table 111 display tab
Page 278 and 279:
Resolve name on Network address, Re
Page 280:
280 Sniffer Portable Professional
show all

Sniffer® Portable Professional User's Guide - NetScout

Create successful ePaper yourself

Delete template?

Save as template?