Difference between the event type "Malicious rogue client" and "genericRogueAPDetected"

joshdemb

Hello, 

Could you please tell me the difference between the event type "Malicious rogue client" and "genericRogueAPDetected" ? 

sagar_kuber

Hello Josh,

1) A malicious rogue client is a type of rogue device that connects to a network without explicit permission and is detected by an Access Point (AP). When an AP detects a malicious rogue client, it generates an event with the following details:

Event Type: Malicious rogue client
Event Code: 194
Severity: Warning
Attribute: Rogue Client MAC; Rogue-Type; Monitoring AP-IP @Monitoring AP-MAC
Displayed on the web interface: Malicious rogue client [Rogue Client MAC] detected by [Rogue Type] by [Monitoring AP-IP @Monitoring AP-MAC]
Description: This event occurs when an AP detects a malicious rogue client.

Refer following KBA for more details: https://support.ruckuswireless.com/articles/000001715

2) The event 'genericRogueAPDetected' refers to the detection of a rogue Access Point (AP) by an AP. Here are the details of this event:

Event Type: genericRogueAPDetected
Event Code: 180
Severity: Informational
Attribute: "apMac"="xx:xx:xx:xx:xx:xx", "rogueMac"="xxx.xxx.xxx.xxx", "ssid"="xxxxxxxxxx", "channel"="xx"
Displayed on the web interface: Rogue AP[{rogueMac}] with SSID[{ssid}] is detected by [{apName&&apMac}] on channel[{channel}]
Description: This event occurs when the AP detects a rogue AP.

Refer following KBA for more details: https://support.ruckuswireless.com/articles/000010538

Regards

Sagar Kuber

Staff Technical Support Engineer- EMEA