Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

SSID Tracing

Hi All,

we currently have NCS running and it has reported a rouge SSID being broadcast over a 3g connection ( this SSID is offencive to the university), if i have a look at NCS it tells me the controller that picked up the rouge SSID but not what AP can see it. is there a way to dind out what AP is seeing this SSID?

i have checked on the controller and NCS and have got no were as this client is not associated to any AP they are just broadcasting there own SSID. 

13 REPLIES

Re: SSID Tracing

Scott: what AP detected the rogue should be known (AFAIK).

I have currently no access to my WCS. Possibly tomorrow I will check for you.

Try go to the WLC that reported the rogue and check.

Try do a rogue report and see what options available.

Sent from Cisco Technical Support iPad App

Rating useful replies is more useful than saying "Thank you"
Hall of Fame Super Silver

Re: SSID Tracing

Scott,

If you can see the rogue ap in the rogue list on the WLC, the WLC should tell you what APs hear that SSID and the signal the APs gears that SSID. You should be able to then go to that area and use a tool to locate that device. Like AA mentioned, you can run a report and look through that also.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

Re: SSID Tracing

Find the attached from WCS. I highlighted where the detector AP is mentioned.

With NCS things are almost similar.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"
Hall of Fame Super Gold

SSID Tracing

Sorry Scott but I don't understand what you are trying to do.

Are you trying to LOCATE/Triangulate the offending client broadcasting the offensive SSID using WCS/NCS?

Hall of Fame Super Silver

Re: SSID Tracing

Not using WCS/NCS. I've had clients that have the same issue and not using WCS/NCS, if the device shows up in the rogue list, we were able to take a look at the APs that heard the device the strongest (-60 or better) and was able to go to go tho that area, they know where all the access points are located, and actually find the devices. Using the wlc, we had active devices on the list. Makes sense?

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Hall of Fame Super Gold

SSID Tracing

Yeah.  Love using the WLC to triangulate stuffs.  LOL

Hall of Fame Super Silver

SSID Tracing

Well when they don't want to buy WCS/NCS, you really have no choice... well they don't:)

-Scott
*** Please rate helpful posts ***
Hall of Fame Super Silver

Re: SSID Tracing

Oh I forgot mention, I don't tell my clients to triangulate, I just tell them to look for the AP that hears the hottest signal and go there with a tool to hunt the device down:)

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
New Member

Re: SSID Tracing

Hi all,

I am using WCS, attached is all that i get.

Message was edited by: Scott O'Brien

Hall of Fame Super Silver

Re: SSID Tracing

Forget that one.... Look at the signal, it's not even close to your wireless network. I would only be worried with signals -65 or hotter.

Sent from Cisco Technical Support iPad App

-Scott
*** Please rate helpful posts ***
New Member

Re: SSID Tracing

Thanks, it is a bit worrying that it only showed what controller had seen the rouge SSID and not what AP

Re: SSID Tracing

Can you try pressing on "Rogue AP history" link in the page you provided the image for?

Also, I can see the rogue AP is classified as friendly one. Can you confirm if the case is still the same with unclassified rogues?

Rating useful replies is more useful than saying "Thank you"
Hall of Fame Super Silver

Re: SSID Tracing

Scott,

It's most likely because it's not active at the moment and that is why no APs are detecting that ap. look on the wlc and see the info on a rogue ap, you will see details. Once that ap is gone, that ap will not show up. WCS will still have the rogue as its not purged.... That is the big difference. Like AA mentioned if you look at the history you might see the details with access point that did detect that ap.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
479
Views
0
Helpful
13
Replies
CreatePlease to create content