User`s manual

350
DWS-1008 User’s Manual
D-Link Systems, Inc.
Rogue Detection and Countermeasures
Active scan Active scan sends probe any
requests (probes with a null SSID
name) to look for rogue APs.
Active scan is congurable on a
radio-prole basis.
Yes No
D-Link AP
signature
Value in an AP’s management
frames that identies the AP to
MSS. AP signatures help prevent
spoong of the AP MAC address.
No No
Log messages
and traps
Messages and traps for rogue
activity.
Yes Yes
Conguring Rogue Detection Lists
The following sections describe how to congure lists to specify the devices that are allowed
on the network and the devices that MSS should attack with countermeasures.
Conguring a Permitted Vendor List
The permitted vendor list species the third-party AP or client vendors that are allowed on the
network. MSS does not list a device as a rogue or interfering device if the device’s OUI is in
the permitted vendor list.
By default, the permitted vendor list is empty and all vendors are allowed. If you congure a
permitted vendor list, MSS allows only the devices whose OUIs are on the list. The permitted
vendor list applies only to the switch on which the list is congured. DWS-1008 switches do
not share permitted vendor lists.
To add an entry to the permitted vendor list, use the following command:
set rfdetect vendor-list {client | ap} mac-addr
The following command adds an entry for clients whose MAC addresses start with aa:bb:
cc:
DWS-1008# set rfdetect vendor-list client aa:bb:cc:00:00:00
success: MAC aa:bb:cc:00:00:00 is now in client vendor-list.
The trailing 00:00:00 value is required.
To display the permitted vendor list, use the following command:
show rfdetect vendor-list