3Com 3CRWX120695A - RF Detection Scans; Countermeasures

470 CHAPTER 11: DETECTING AND COMBATTING ROGUE DEVICES
to a wireless laptop. Users can configure a wireless network interface card
(NIC) in “ad hoc” mode and easily set up a simple peer-to-peer network.
Although this WLAN might be isolated from the corporate WLAN, the
users are stealing the air from legitimate WLAN users. The private WLAN
can also cause RF interference with an authorized WLAN in other parts of
the company.
RF Detection Scans All radios continually scan for other RF transmitters. Radios perform
passive scans and active scans:
■ Passive scans — The radio listens for beacons and probe responses.
■ Active scans — The radio sends probe any requests (probe requests
with a null SSID name) to solicit probe responses from other access
points.
Radios perform both types of scans on all channels allowed for the
country of operation (set by the country code when you created the
network plan). 802.11b/g radios scan in the 2.4 GHz to 2.4835 GHz
spectrum. 802.11a radios scan in the 5.15 GHz to 5.85 GHz spectrum.
Both enabled radios and disabled radios perform these scans.
Dynamic Frequency Selection (DFS)
Some regulatory domains require conformance to ETSI document
EN 301 893. Section 4.6 of that document specifies requirements for
Dynamic Frequency Selection (DFS). These requirements apply to radios
operating in the 5 GHz band (802.11a radios).
In countries where Dynamic Frequency Selection (DFS) is required, MSS
performs the appropriate check for radar. If radar is detected on a
channel, the MAP radio stops performing active scans on that channel in
accordance with DFS. However, the radio continues to passively scan for
beacons from rogue devices.
Countermeasures You can enable MSS to use countermeasures against rogues.
Countermeasures consist of packets that interfere with a client’s ability to
use the rogue.
Countermeasures are disabled by default. When you enable them, all
devices of interest that are not in the known devices list become viable
targets for countermeasures. The Mobility Domain’s seed WX switch