Installation guide

Chapter 10
154 Sniffer Technologies
In addition, you must also have enabled the Enable Rogue AP Lookup option
on the 802.11 Options tab. When the Enable Rogue AP Lookup option is
enabled, each time the Expert discovers a new access point, it will compare its
MAC address to those in its list of known access points. If the discovered
address is not found, the Expert generates the Rogue Access Point alarm. In
addition, the Expert displays will identify the offending access point as a rogue
(the word “Rogue” will appear in parentheses following the station's entries in
Expert Summary and Detail displays).
Possible Cause
In most cases, this is a relatively minor alarm, probably indicating nothing more
than that you neglected to add the address of a known access point to the
Expert's list. However, you may want to examine the address of the access
point indicated in the alarm to make sure that it is not an intruder.
Rogue Mobile Unit
The Expert generates the Rogue Mobile Unit alarm when it detects a mobile
unit on the wireless network whose MAC address is not found in its list of
known mobile units. You can view the Expert's list of known mobile units in the
Known Mobile Units in the Network listbox in the 802.11 Options tab of the
Expert Properties dialog box. You access this tab by selecting Expert Options
from the Tools menu and clicking the 802.11 Options tab in the dialog box
that appears.
The Rogue Mobile Unit alarm provides you with a convenient means of
detecting mobile units on the network of which you were previously unaware.
To use this alarm effectively, you must add the MAC addresses of the known
mobile units on the network to the Expert's list. You can add mobile units to the
Expert's list in any of the following ways:
 Automatically in the real-time Host Table by selecting entries in the
table, right-clicking, and selecting the Add to Known Mobile Unit List
command.
 Automatically in the postcapture display's Expert tab by clicking the
Wireless Unit List button and using the options in the dialog box that
appears.
 Manually in the Tools > Expert Options > 802.11 Options tab.
In addition, you must also have enabled the Enable Rogue Mobile Unit
Lookup option on the 802.11 Options tab. When the Enable Rogue Mobile
Unit Lookup option is enabled, each time the Expert discovers a new mobile
unit, it will compare its MAC address to those in its list of known mobile units.
If the discovered mobile unit is not found, the Expert generates the Rogue
Mobile Unit Detected alarm. In addition, the Expert displays will identify the
offending mobile unit as a rogue (the word “Rogue” will appear in parentheses
following the station's entries in Expert Summary and Detail displays).