Using the New Rogue Devices Report

The New Rogue Devices Report summarizes rogue device information including the following categories of information:

• Rogue devices by RAPIDS classification—described in Using RAPIDS
• Top rogue devices by number of discovering APs
• Top rogue devices by signal strength
• Graphical summary of rogue devices by LAN MAC address vendor
• Graphical summary of rogue devices by radio MAC address vendor
• Text-based table summary of rogue device counts
• Detailed and text-based table of rogue devices discovered wirelessly, with extensive device parameters and hyperlink interoperability to additional AirWave pages
• Detailed and text-based table of all rogue devices supporting all discovery methods with extensive device parameters and hyperlink interoperability to additional AirWave pages
• Detailed and text-based table of discovery events pertaining to the discovery of rogue devices with extensive parameters and hyperlink interoperability to additional AirWave pages

This report is not run by default, but is available after you define it.

Refer to Figure 1 for a sample illustration of this report.

Figure 1  New Rogue Devices Report Illustration (partial view)

 

The rogue device inventories that comprise this report contain many fields, described in Table 46.

Table 46: New Rogue Devices Report Fields

Field	Description
Name	Displays the device name, if it can be determined.
RAPIDS Classification	Displays the RAPIDS classification for the rogue device, as classified by rules defined on the RAPIDS > Rules page. Refer to Using RAPIDS for additional information.
Threat Level	Displays the numeric threat level by which the device has been classified, according to rules defined on the RAPIDS > Rules page. Refer to Using RAPIDS for additional information.
Ack	Indicates whether the device has been acknowledged with the network.
First Discovered	Displays the date and time that the rogue device was first discovered on the network.
First Discovery Method	Displays the method by which the rogue device was discovered.
First Discovery Agent	Displays the network device that first discovered the rogue device.
Last Discovering AP	Displays the network device that most recently discovered the rogue device.
Model	Displays the rogue device type when known.
Operating System	Displays the operating system for the device type, when known.
IP Address	Displays the IP address of the rogue device when known.
SSID	Displays the SSID for the rogue device when known.
Network Type	Displays the network type on which the rogue was detected, when known.
Channel	Displays the wireless RF channel on which the rogue device was detected.
WEP	Displays WEP encryption usage when known.
RSSI	Displays Received Signal Strength (RSSI) information for radio signal strength when known.
Signal	Displays signal strength when known.
LAN MAC Address	Displays the MAC address for the associated LAN when known.
LAN Vendor	Displays LAN vendor information associated with the rogue device, when known.
Radio MAC Address	Displays the MAC address for the radio device, when known.
Radio Vendor	Displays the vendor information for the radio device when known.
Port	Displays the router or switch port associated with the rogue device when known.
Last Seen	Displays the last time in which the rogue device was seen on the network.
Total Discovering APs	Displays the total number of APs that detected the rogue device.
Total Discovery Events	Displays the total number of instances in which the rogue device was discovered.