Security Management

Rogue Detection, Classification, and Management

Rogue Detection

A device is classified as rogue when it is not known by a controller. So the rogue detection is accomplished through registered APs, thanks to which a wireless LAN controller (WLC) can observe APs and wireless clients that are not part of the wireless infrastructure. To be classified as such, a rogue AP or client needs to be detected twice.

To detect a rogue AP or client, an AP in local mode needs to cease serving clients and listen for noise on its channel for 50 milliseconds. You can configure the frequency and channels on which APs in local mode will scan for rogue beacons and off-channel noise in the Auto Radio Frequency (RF) and Dynamic Channel Assignment (DCA) menus of the controller, under the 802.11a/n and 802.11b/g/n radio settings. You also need to configure the registered AP either in local mode or in monitor mode, to be able to scan for rogue beacons.