Sniffer® Portable Professional User's Guide - NetScout

Identifying Rogue Hosts on the Wireless Network
Monitoring Your Network
Sniffer Portable Professional helps you identify unknown units on your
wireless network, both during monitoring and live capture. In general,
this feature works by comparing detected addresses to a list of Known
and Neighbor addresses. Addresses not found in this list are flagged as
rogues in Sniffer Portable Professional displays. The figure below
summarizes the process:
1. Enable Rogue Lookup for Access Points and/or Mobile Units
in either Tools > Wireless > Rogue (shown) or Tools > Expert
Options > 802.11 Options. See Configuring Rogue
Identification for Wireless Networks on page 61 for details.
2. All wireless entities start out as rogues.
Add wireless entities as Known or Neighbors
to change their classification. The easiest
way to do this is by checking entries in the #
column of the Host Table’s 802.11 tab and
right-clicking. However, there are several
ways to do this – see Adding Known
Addresses to the List on page 62.
3. Review the Status column in the Host
Table, as well as Expert displays to review
the Known/Neighbor/Rogue classification
of wireless entities. See Rogue
Identification in Sniffer Portable
Professional Displays on page 62 for
information on where Sniffer Portable
Professional reports this status.
User’s Guide 91