Let me know differente between Mark As Know and Kark As Malicious.

[ko_lin_9y97fkm6]

I using ZD 1200 with 10.1.1.0 build 55. I'm not clear about below Rogue. How can I block these Rouge SSID.


Have a good day,

Lin

[albert_pierson]

Hi Ko Lin,

Ruckus detects any AP sending beacons as "rogue" devices when in reality many of them are just neighbor devices.

Malicious rogues are devices that are detected attempting to attack the Ruckus Network via spoofing of MAC, BSSID, or on the same (protected Network) as the Ruckus AP's. 

Only AP's that are identified as doing malicious operations can be blocked by the Ruckus WIPS feature.

When genuine AP receives the update list from ZD, it will know who is malicious AP, then it will send deauth to those Mal APs on the channel it detected the mal APs.

Please be careful as MAC and BSSID spoofed AP's may also deauthenticate actual approved client devices on Ruckus AP's and not just the "Malicious rogue" devices

Other Neighbor AP's cannot be blocked as users of unlicensed band and blocking other users may be a violation of local radio regulations.

Please check some of the following articles in Ruckus Knowledge base:

• Ruckus Rogue Detection type classification

  Type of Rogue Access Points detected by Ruckus ZoneFlex system
  https://support.ruckuswireless.com/articles/000001261

• rogue client detection 

  Is Ruckus ZD able to detect ad-hoc connection or any hotspot service initiated by the wireless client?
  https://support.ruckuswireless.com/articles/000001715
  

• Details on Rogue APs and Rogue DHCP 

  Query on Rogue -APs Vs Rogue -DHCP
  https://support.ruckuswireless.com/articles/000003248

I hope this answers your question

Thanks for selecting Ruckus Wireless