Working with the Mitigator
A31003-W1040-U101-1-7619, July 2006 DRAFT
222 HiPath Wireless Controller, Access Points and Convergence Software V4.0, C10/C100/C1000 User Guide
hwc_mitigator.fm
Analysis engine overview
10.4 Analysis engine overview
The Analysis engine relies on a database of known devices on the Controller, Access Points
and Convergence Software system. The Analysis engine compares the data from the RF Data
Collector with the database of known devices.
This database includes the following:
● Wireless APs – Registered with any HiPath Wireless Controller with its RF Data Collector
enabled and associated with the Analysis Engine on this HiPath Wireless Controller.
● Third-Party APs – Defined and assigned to a VNS.
● Friendly APs – A list created in the Mitigator user interface as potential rogue access
points are designated by the administrator as Friendly.
● Wireless Devices – Registered with any HiPath Wireless Controller that has its RF Data
Collector enabled and has been associated with the Analysis Engine on this HiPath
Wireless Controller.
The Analysis Engine looks for access points with one or more of the following conditions:
● Unknown MAC address and unknown SSID (critical alarm)
● Unknown MAC, with a valid SSID - a known SSID is being broadcast by the unknown
access point (critical alarm)
● Known MAC, with an unknown SSID - a rogue may be spoofing a MAC address (critical
alarm)
● Inactive Wireless AP with valid SSID (critical alarm)
● Inactive Wireless AP with unknown SSID (critical alarm)
● Known Wireless AP with an unknown SSID (major alarm)
● In ad-hoc mode (major alarm)
10.5 Working with Mitigator scan results
When viewing the Mitigator scan results you can delete all or selected Access Points from the
scan results. You can also add Access Points from the scan results to the Friendly AP list.
>
In the current release, there is no capability to initiate a DoS attack on the detected
rogue access point. Containment of a detected rogue requires an inspection of the
geographical location of its Scan Group area, where its RF activity has been found.
To Next Page
Loading...
