All this is done manually. You shouldn't have rogue containment on and RLDP really should be disabled on client access APs. If you have the time to look for these and hunt them down, then that is what you need to do. To be honest, you can't prevent people from bringing in their own hotspot especially now when a phone can be a hotspot.
Transferring Crash file from standby: Login to the Active WLC in HA.
From CLI: (Cisco Controller) >transfer upload datatype crash (Cisco
Controller) >transfer upload filename (Cisco
Controller) >transfer upload mode tftp (Cisco Controller) >transfer
This is the start of a display filter cross reference between Wireshark
and OmniPeek. The 1st installment is a table of advanced filters. More
filters will be added as time allows. It is a living doc, so check back
for changes every so often Please feel f...