The Active Threats report lists all currently detected threats. Active threats are devices that are being detected performing attacks on the authorized network. Threat APs are identified as APs that have been detected to be performing one or more types of attacks on the authorized network. The report only lists currently active threats, not historic threats. For more information, see Threat History.
Active Threats Report - Fields and Buttons
| Field/Button | Description |
|---|---|
| Detected Active At | Date and time that the threat was identified. |
| Threat MAC Address | MAC address of the device. |
| Threat | Type of threat. |
| Threat Category | For more information, see Security Threats. |
| Countermeasures Applied | Indicates if a countermeasure has been applied. |
| Location - AP Name | Name of the threat AP. |
| Location - RSS | Threat AP Received Signal Strength (displayed in dBm). |
| Additional Details | Details of the threat including frequency,
SSID, and Rogue Threats. Rogue threats details are accessed by clicking 3 dots “...” that display in the column. The following parameters display in the Rogue Details dialog: Sent MAC address: Sent wireless test packet source MAC address. Received MAC address: Received wired test packet source MAC address. Sent IP address: Wireless test packet source IP address. This IP address is automatically assigned via DHCP (Dynamic Host Configuration Protocol) (DHCP is through the Rogue AP). Received IP address: Wired test packet source IP address. TTL difference: TTL (Time-To-Live or hop limit) difference between sent wireless test packet TTL and received wireless test packet TTL. For example, if the TTL of the sent wireless test packet is 64 and the TTL of the received wireless test packet is 62, then the TTL difference is 2 indicating the packet went through 2 hops. Learned gateway: Wireless gateway IP address as specified from the DHCP server (DHCP is through the Rogue AP). |
Print
this page
Email this topic
Feedback
View PDF
Download EPUB