4 ms·
That's my take on it as well. Per the linked docs, the only modes natively supported are: - Rogue on Wire - If a rogue device is identified to be attached to t
by tjohns 12y ago
That's my take on it as well. Per the linked docs, the only modes natively supported are:
- Rogue on Wire - If a rogue device is identified to be attached to the wired network, then it is automatically placed under containment.
- Using our SSID - If a rogue device is using an SSID which is the same as that configured on the controller, it is automatically contained. This feature aims to address a honey-pot attack before it causes damage.
- Valid client on Rogue AP - If a client listed in ACS is found to be associated with a rogue device, containment is launched against that client only, preventing it from associating to any non-managed AP.
- AdHoc Rogue AP - If an ad-hoc network is discovered, it is automatically contained.
The kind of blocking in question here sounds more aggressive than any of these categories. Though it's certainly possible they were using some other vendor's gear which has additional options.
- cpwright 12y agoThe AdHoc Rogue AP sounds very much like what they were doing; which may be reasonable in some contexts, but it would seem not to be in semi-public building. One of the important issues here is that wireless communication doesn't respect boundaries. It seems they could have easily been interfering with networks on neighboring properties.
- rahimnathwani 12y ago> The AdHoc Rogue AP sounds very much like what they were doing I don't think so. This mode targets ad hoc networks. Mifi devices and iPhone/Android tethering set up access points, not ad hoc networks.
- ObviousScience 12y agoKnocking down an AdHoc AP of two guys privately playing Starcraft on a LAN would likely be against FCC policy, for example, and automated AdHoc containment is dangerous unless you can identify the source, as it may not be part of your network or operating on your equipment.