18 ms·
> Once a rogue client is detected on the wired network, the network administrator is able to contain both the rogue AP and the rogue clients. This can be achiev
by lmz 12y ago
> Once a rogue client is detected on the wired network, the network administrator is able to contain both the rogue AP and the rogue clients. This can be achieved because 802.11 de-authentication packets are sent to clients that are associated to rogue APs so that the threat that such a hole creates is mitigated.
Looks like the Cisco AP sends these deauthentication packets over wireless, it doesn't cut off the rogue AP from the network by filtering it or disabling a switch port. The rogue AP is certainly bridged to your network, but is the association between the clients and the rogue AP part of your network?
- iancarroll 12y agoThat doesn't look good. It is mentioned near the start about potential issues: > rogue containment usually introduces legal issues that can put the infrastructure provider in an uncomfortable position if left to operate automatically. The FCC also says selling these things is illegal: > Federal law prohibits the operation, marketing, or sale of any type of jamming equipment There might be a legal workaround in the case of unauthorized devices, as I doubt Cisco's legal team would allow such a feature if there was not something to base it off of. It is concerning though...