Ruckus Wireless ZoneDirector 3000, User Manual, Page: 292 / 430

Detecting Rogue Access Points
Access Point Sensor Information
292
Ruckus Wireless, Inc.
1 Go to Monitor > Rogue Devices . (You can also click the “ #of Rogue Devices ”
link from the Devices Overview widget on the Dashboard.)
Figure 154. Rogue devices indicator
2 When the Monitor > Rogue Devices page appears, three tables are listed:
• Currently Active Rogue Devices : Lists all currently detected rogue APs.
• Known/Recognized Rogue Devices : Lists rogue APs that have been marked
as known, typically neighbor APs.
• User Blocked Rogue Devices : Lists devices that have been marked as
malicious by the user.
3 Review the Currently Active Rogue Devices table. The following types of Rogue
APs generate an alarm when ZoneDirector detects them (if the alarm has been
enabled from the
Configure > Alarms page):
• AP : A normal rogue AP. This rogue AP has not yet been categorized as
malicious or non-malicious.
• malicious AP (SSID-spoof) : A malicious rogue AP that uses the same SSID
as ZoneDirector’s AP, also known as an Evil-twin AP .
• malicious AP (MAC-spoof ): A malicious rogue AP that has the same BSSID
(MAC) as one of the virtual APs managed by ZoneDirector.
• malicious AP (Same-Network) : A malicious rogue AP that is connected to the
same wired network.
• malicious AP (User-Blocked ): A rogue AP that has been marked as malicious
by the user.
4 To mark an AP as malicious, click Mark as Malicious . This AP will now be
blocked and listed in the User Blocked Rogue Devices table. The malicious rogue
AP protection mechanism (enabled from the
Configure > WIPS > Intrusion
Detection and Prevention page) is automatically applied to all rogue APs
categorized as “malicious”, whether user-blocked or another type.
5 If a listed AP is part of another, known neighbor network, click Mark as Known .
This identifies the AP as posing no threat, while copying the record to the Known/
Recognized Rogue Devices table.