×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

SSID Tracing

Unanswered Question
Aug 2nd, 2012
User Badges:

Hi All,


we currently have NCS running and it has reported a rouge SSID being broadcast over a 3g connection ( this SSID is offencive to the university), if i have a look at NCS it tells me the controller that picked up the rouge SSID but not what AP can see it. is there a way to dind out what AP is seeing this SSID?


i have checked on the controller and NCS and have got no were as this client is not associated to any AP they are just broadcasting there own SSID. 

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Amjad Abdullah Fri, 08/03/2012 - 03:40
User Badges:
  • Red, 2250 points or more

Scott: what AP detected the rogue should be known (AFAIK).

I have currently no access to my WCS. Possibly tomorrow I will check for you.

Try go to the WLC that reported the rogue and check.

Try do a rogue report and see what options available.


Sent from Cisco Technical Support iPad App

Scott Fella Fri, 08/03/2012 - 05:55
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Scott,


If you can see the rogue ap in the rogue list on the WLC, the WLC should tell you what APs hear that SSID and the signal the APs gears that SSID. You should be able to then go to that area and use a tool to locate that device. Like AA mentioned, you can run a report and look through that also.


Sent from Cisco Technical Support iPhone App

Amjad Abdullah Sat, 08/04/2012 - 01:32
User Badges:
  • Red, 2250 points or more

Find the attached from WCS. I highlighted where the detector AP is mentioned.

With NCS things are almost similar.


HTH


Amjad

Attachment: 
Leo Laohoo Sat, 08/04/2012 - 04:02
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 LAN, Wireless

Sorry Scott but I don't understand what you are trying to do.


Are you trying to LOCATE/Triangulate the offending client broadcasting the offensive SSID using WCS/NCS?

Scott Fella Sat, 08/04/2012 - 07:22
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Not using WCS/NCS. I've had clients that have the same issue and not using WCS/NCS, if the device shows up in the rogue list, we were able to take a look at the APs that heard the device the strongest (-60 or better) and was able to go to go tho that area, they know where all the access points are located, and actually find the devices. Using the wlc, we had active devices on the list. Makes sense?


Sent from Cisco Technical Support iPhone App

Leo Laohoo Sat, 08/04/2012 - 16:53
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 LAN, Wireless

Yeah.  Love using the WLC to triangulate stuffs.  LOL

Scott Fella Sat, 08/04/2012 - 18:28
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Well when they don't want to buy WCS/NCS, you really have no choice... well they don't:)

Scott Fella Sun, 08/05/2012 - 12:42
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Oh I forgot mention, I don't tell my clients to triangulate, I just tell them to look for the AP that hears the hottest signal and go there with a tool to hunt the device down:)


Sent from Cisco Technical Support iPhone App

Scott Fella Sun, 08/05/2012 - 18:24
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Forget that one.... Look at the signal, it's not even close to your wireless network. I would only be worried with signals -65 or hotter.


Sent from Cisco Technical Support iPad App

Scott O'Brien Sun, 08/05/2012 - 21:07
User Badges:

Thanks, it is a bit worrying that it only showed what controller had seen the rouge SSID and not what AP

Amjad Abdullah Mon, 08/06/2012 - 03:31
User Badges:
  • Red, 2250 points or more

Can you try pressing on "Rogue AP history" link in the page you provided the image for?

Also, I can see the rogue AP is classified as friendly one. Can you confirm if the case is still the same with unclassified rogues?

Scott Fella Mon, 08/06/2012 - 03:58
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    The Hall of Fame designation is a lifetime achievement award based on significant overall achievements in the community. 

  • Cisco Designated VIP,

    2017 Wireless

Scott,


It's most likely because it's not active at the moment and that is why no APs are detecting that ap. look on the wlc and see the info on a rogue ap, you will see details. Once that ap is gone, that ap will not show up. WCS will still have the rogue as its not purged.... That is the big difference. Like AA mentioned if you look at the history you might see the details with access point that did detect that ap.


Sent from Cisco Technical Support iPhone App

Actions

This Discussion