cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1155
Views
0
Helpful
13
Replies

SSID Tracing

Scott O'Brien
Level 1
Level 1

Hi All,

we currently have NCS running and it has reported a rouge SSID being broadcast over a 3g connection ( this SSID is offencive to the university), if i have a look at NCS it tells me the controller that picked up the rouge SSID but not what AP can see it. is there a way to dind out what AP is seeing this SSID?

i have checked on the controller and NCS and have got no were as this client is not associated to any AP they are just broadcasting there own SSID. 

13 Replies 13

Amjad Abdullah
VIP Alumni
VIP Alumni

Scott: what AP detected the rogue should be known (AFAIK).

I have currently no access to my WCS. Possibly tomorrow I will check for you.

Try go to the WLC that reported the rogue and check.

Try do a rogue report and see what options available.

Sent from Cisco Technical Support iPad App

Rating useful replies is more useful than saying "Thank you"

Scott Fella
Hall of Fame
Hall of Fame

Scott,

If you can see the rogue ap in the rogue list on the WLC, the WLC should tell you what APs hear that SSID and the signal the APs gears that SSID. You should be able to then go to that area and use a tool to locate that device. Like AA mentioned, you can run a report and look through that also.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

Amjad Abdullah
VIP Alumni
VIP Alumni

Find the attached from WCS. I highlighted where the detector AP is mentioned.

With NCS things are almost similar.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"

Leo Laohoo
Hall of Fame
Hall of Fame

Sorry Scott but I don't understand what you are trying to do.

Are you trying to LOCATE/Triangulate the offending client broadcasting the offensive SSID using WCS/NCS?

Not using WCS/NCS. I've had clients that have the same issue and not using WCS/NCS, if the device shows up in the rogue list, we were able to take a look at the APs that heard the device the strongest (-60 or better) and was able to go to go tho that area, they know where all the access points are located, and actually find the devices. Using the wlc, we had active devices on the list. Makes sense?

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

Yeah.  Love using the WLC to triangulate stuffs.  LOL

Well when they don't want to buy WCS/NCS, you really have no choice... well they don't:)

-Scott
*** Please rate helpful posts ***

Oh I forgot mention, I don't tell my clients to triangulate, I just tell them to look for the AP that hears the hottest signal and go there with a tool to hunt the device down:)

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

Hi all,

I am using WCS, attached is all that i get.

Message was edited by: Scott O'Brien

Forget that one.... Look at the signal, it's not even close to your wireless network. I would only be worried with signals -65 or hotter.

Sent from Cisco Technical Support iPad App

-Scott
*** Please rate helpful posts ***

Thanks, it is a bit worrying that it only showed what controller had seen the rouge SSID and not what AP

Can you try pressing on "Rogue AP history" link in the page you provided the image for?

Also, I can see the rogue AP is classified as friendly one. Can you confirm if the case is still the same with unclassified rogues?

Rating useful replies is more useful than saying "Thank you"

Scott,

It's most likely because it's not active at the moment and that is why no APs are detecting that ap. look on the wlc and see the info on a rogue ap, you will see details. Once that ap is gone, that ap will not show up. WCS will still have the rogue as its not purged.... That is the big difference. Like AA mentioned if you look at the history you might see the details with access point that did detect that ap.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: