Wireless: How long does it takes for sonicpoint to start building Rogue Access point list and does it interfere with the schedule during which WIDP sensor is turned on?

Do sonicpoints takes longer time to detect Rogue Access points ?

If Yes, How long does it takes for sonicpoint to start building Rogue Access point list and does it interfere with the schedule during which WIDP sensor is turned on?

Answer :

WIDP Sensor mode will  keep doing packet sniffer to rogue AP and catch the client associate with rogue AP on each channel one by one periodically.

The time also depends on client active probe enabled or not. 

In order to detect Rouge AP immediately, you can run IDS scan which will add rouge AP per scan result it gets.

• In order to detect Rouge AP immediately, we can run IDS which will add rouge AP per scan result is got.  Any exact time period after which Rogues AP will be added. Is it in terms of minutes, hours or days?

 Answer is - IDS scan can return result in less than 1 minute. Rogues AP will be added as soon as result return.

• Is there a best practice for WIDP when there isn’t a dedicated device, how long do we need to shutdown wireless network access (as the access point is in scan mode) to get a decent result?

Answer is - We can’t know when the rogue AP will appear on network. It can’t evaluate how long need.

• Is 30 minutes for access points to run as WIDP sensors, is this sufficient?

          Answer is - We can’t know when the rogue AP will appear on network. It can’t evaluate how long need.

• If a wireless device (phone, laptop, etc) utilizes a rogue access point it is added to “rogue devices” along with the access point. If we then authorize the access point, the wireless device is still considered rogue and will be blocked. Is this something we can control using block Rogue AP and its associated clients?

Answer is - Client associates authorized AP won’t be affected and blocked.

• Does the Rogue Access point list  automatically flushed ? If yes for after how many minutes or we need to manually delete?

Answer is No.