426 Detecting and Combatting Rogue DevicesNN47250-102 (320666-G Version 02.01)Displaying Rogue InformationTo display rogue information, select the Alarms option in the main WLAN Management Software tool bar,and filter the information so that only alarms related to rogue devices are displayed.To do this, adjust the selection criteria on the fault dashboard. In the example below, the alarms are filtered sothat only alarms from the WSS AlphaWSS1-(2380 or 2382) that contain “rogue” in the Description field aredisplayed.Each rogue is listed only once, even if multiple entries for the rogue appear in the Events Log. For example, ifa rogue is detected during three polling intervals, separate entries for each polling interval appear in the EventsLog.You can adjust the selection criteria on the fault dashboard to filter the alarm list to display the following typesof entries:• Rogue APs—APs that are on the Nortel network but do not belong there.• Interfering APs—Devices that are not part of the Nortel network but also are not rogues. No clientsconnected to these devices have been detected communicating with any network entity listed in theforwarding database (FDB) of any WSS in the Mobility Domain. Although interfering devices are notconnected to your network, they might be causing RF interference with AP radios.• Ad-hoc clients—Wireless clients who are configured to communicate wirelessly outside of the networkinfrastructure. Ad-hoc clients are not necessarily malicious, but they do steal bandwidth from yourinfrastructure users.Ad-hoc clients are further categorized into rogues and interfering devices. The word Rogue orInterfering appears in parentheses next to the word Ad-hoc.
