Rogue Clients

View, filter, sort, select, and classify rogue and unauthorized client objects. (ExtremeCloud IQ only.)

View Rogue Clients

Items appear in this window if you enable devices with a WIPS (wireless intrusion prevention system) configuration that includes ad hoc network detection, and these devices detect wireless client stations participating in an ad hoc network.

  • Devices can only detect a rogue client in an ad hoc network if the client is using the same channel as the device access radio and if the device has background scanning enabled on that radio.

The Rogue Clients table displays all of the rogue clients that have been detected in your network. You can choose to show in-net rogues, unauthorized rogues, or the rogues that have been removed from your network.

  • The Rogue Clients table has variable-width columns to display longer entries. Select and drag the right edge of any column left or right to change the column width. Some columns are sortable; select the column heading to sort column entries.

You can view real-time or historical data for rogue clients. The timeline options at the top of the page allow you to select a time range (for example a specific day or week, and time), and then use the slider bars on the timeline to narrow the window. Historical data is retained for one week.

The Rogue Clients table contains the following information:

MAC Address: The MAC address of the rogue client.

Vendor: The vendor of the rogue client.

Classification: Whether this client is considered a true rogue or a neighbor client.

SSID: The SSID that is being announced by the client beacons.

Approximate Location: The location of the client in your network, or the location of the AP that reported the rogue.

Device Name: The authorized device in your network that reported the rogue client.

First Time Detected: The time when this client was first detected.

Last Time Reported: The last time this rogue client was reported in your network.

Filter the Rogue Client Display

To filter the display of rogue clients, select . In the left navigation bar, you can create and save filters for viewing rogue APs. You can filter the information by device location or network SSIDs. Select the check box for the items you want to include in your filter, and then select Save. In the dialog box, enter a name for the filter and select Save. Once you save a filter, it appears in the top section of the left navigation bar.

Classify Rogue Clients

You can reclassify any of the rogue clients shown on this table. Select the check box for the client and select Classify at the top left. From the drop-down list, select Neighbor, Removed, or Auto-classify.