Cisco Cisco 5508 Wireless Controller Referencia técnica

Rogue IP address

First and last time the rogue is reported

Channel width

In order to export rogue events to a third-party Network Management System (NMS) for archival, the 
WLC permits additional SNMP trap receivers to be added. When a rogue is detected or cleared by the 
controller, a trap containing this information is communicated to all SNMP trap receivers. One caveat 
with exporting events via SNMP is that if multiple controllers detect the same rogue, duplicate events 
are seen by the NMS as correlation is only done at PI.

Once a rogue AP has been added to the WLC's records, it will remain there until it is no longer seen. 
After a user configurable timeout (1200 seconds default, configurable from 120 to 3600 sec.), a rogue 
in the “Unclassified” category is aged out. Rogues in other states such as “Contained” and “Friendly” 
will persist so that the appropriate classification is applied to them if they reappear.

There is a maximum database size for rogue records that is variable across controller platforms:

Number of Max Rogue Client per AP is increased to 256 from 16 from 7.4

By default, all rogues that are detected by the Cisco UWN are considered Unclassified. As depicted in 
this the below graphic, rogues can be classified on a number of criteria including RSSI, SSID, Duration, 
Security type, on/off network, and number of clients:

24000

12000

4000

2000

800

2000

32000

12000

5000

2500

1500

2500