Meru Technical Note - How does the Meru WLAN perform rogue detection?

[nsamuel]

Description

How does the Meru WLAN perform rogue detection?

Scope

KB ARTICLE TYPE: Troubleshooting

RELATED PRODUCTS: AP

RELATED SOFTWARE VERSIONS: N/A

KEYWORDS: AP, rogue, WLAN

Solution

The Meru WLAN can be set for rogue AP detection at the BSSID level. When enabled, an AP enters channel scanning mode for rogue AP detection if it has no clients currently assigned to it. Such an AP, referred to as an "idle AP, " alternates between scanning mode (200 ms) and the normal listening operation (800 ms) until it receives an assignment message. "It then aborts scanning mode and returns to normal operation." When scanning a non-home channel, the AP does not respond to probe requests or beacons, nor does it send any probe indications. It does, however, keep in sync with the controller. To avoid mitigation on all the APs when it is enabled, known APs (both Meru and non-Meru) should be included in the access control list. If the controller detects a rogue AP, then it proceeds to mitigate it provided mitigation is configured (take it off the air).