AirDefense Mobile 4.3. User Guide

Transcription

1 AirDefense Mobile 4.3 User Guide

2 AirDefense Mobile 4.3 User Guide Online Support Call Center Support This document is to be used exclusively by AirDefense employees, authorized dealers, customers and distributors of AirDefense products. The information in this manual is subject to change without notice and should not be construed as a commitment by AirDefense. AirDefense shall in no event be liable for any loss of business, loss of use or data, interruptions in business or for damage of any kind arising from any defect or errors in this publication or in the AirDefense hardware or software. This material may not be reproduced in whole or in part by any means without permission from AirDefense. All other trade names not listed above and referenced in this document are the service marks, trademarks, or registered trademarks of their respective manufacturer(s) and belong to their respective owner(s). Copyright 2007, 2008 AirDefense. All rights reserved AirDefense, Inc North Point Parkway, Suite 100 Alpharetta, GA The comprehensive AirDefense customer support program strives to exceed your expectations with superior customer support. We have experts in security, , networking, hardware, and software that are available to help you with your support requests. AirDefense is available to you 24x7 via our Online Customer Care Tracking System, AirDefense s Support Desk, or . Hours of service and response times are subject to customer care contract terms. Call Center Support International callers: Online Customer Care Tracking: Technical Support may be reached by , at support@airdefense.net. ii AirDefense Mobile 4.3 User Guide

3 Table of Contents Chapter 1. Getting Started Introduction About AirDefense Mobile First Time Startup Local Scanning Remote (Enterprise) Scanning Chapter 2. Controls Select Location Control Panels Show Fields Status Bar Pull-down Menu File View Tools Location Tracking System Help Right-Click Tools Menu Navigation Tree Right-Click Information Panel Right-Click Navigation Trees Navigating to Information Panels using the Tree Using the Navigation Tree with Locate Device Chapter 3. Programs Summary Views Detailed Views Dashboard Device Counts Operations View Security View Discovered APs & Stations Threats Threat Index Screen Access Points Access Point Summary View Access Point Detail View Stations Station Summary View Station Detail View Channels Channel Summary View Channel Detail View Ad Hoc AirDefense Mobile 4.3 User Guide iii

4 Contents Rogue Rogue Summary View Rogue Detail View Chapter 4. Tools Diagnostic Tools Ladder Tool DHCP Tool Ping Tool TraceRoute Tool Live View Live View Filter Live View Details Live View Decodes Locate Device Tool Options Tool General Settings Channel Settings Packet Capture Converting Captured AirDefense Files to PCAP OUI Settings Enterprise Ping Options Notification Settings Alarm Settings Plan Management Floor Plan Editor Advanced Location Tracking Chapter 5. Reports Saving and Printing Reports Device Reports All APs Currently Active APs All Stations Currently Active Stations Unassociated Stations Probing Stations Security Risk Reports Unauthorized APs APs Not Using Encryption APs with IP Address Visible Unauthorized Stations Stations with no Encryption Stations with IP Address Visible Ad Hoc Networks Performance Reports All Devices Access Points Stations iv AirDefense Mobile 4.3 User Guide

5 Contents Channels Appendix A. CSV File Format... A-1 File Format for Importing/Exporting APs... A-1 File Format for Importing/Exporting Stations... A-2 Appendix B. Alarms... B-1 Attack Alarms... B-1 Event Alarms... B-5 Policy Alarms... B-7 Performance Alarms... B-9 AirDefense Mobile 4.3 User Guide v

6

7 Chapter 1. Getting Started Introduction Additional Resources Welcome to AirDefense Mobile, your personal laptop-based WLAN management and control center. AirDefense Mobile is part of the AirDefense family of products, offering Anywhere, Anytime Protection for your wireless network. It can function in standalone mode, performing local scans within antenna sensitivity range, or it can fully integrate into the AirDefense Enterprise solution to receive information on devices in the same location as the user running AirDefense Mobile. The AirDefense Mobile product has the following additional resources to help you use the system more effectively: Online Help System embedded in the AirDefense Mobile Graphical User Interface. AirDefense Mobile 4.3 Installation Guide. About AirDefense Mobile AirDefense Mobile functions as: A standalone product, performing local scans within the broadcast range of your computer A complementary solution to the AirDefense Enterprise monitoring platform, giving you an AirDefense-powered mobile product that performs wireless network scans, device inventory, location tracking, and advanced rogue management of remote locations. Additionally, AirDefense Mobile can integrate with the AirDefense Architect or Survey products, and additional third-party tools such as Ekahau Site Survey software, allowing you to perform site surveys of your network. Running on a Microsoft Windows XP platform, AirDefense Mobile installs easily on any laptop with an Atheros -based a/b/g wireless card, such as NetGear (WAG511) or Cisco (CB21AG). (See Installation Guide or AirDefense Self Support portal for specific card versions supported.) Companies use AirDefense Mobile to: Locate rogue access points and stations Identify devices not configured correctly Identify signal interference Take proactive steps to close any security holes and ensure the health of the wireless LAN. AirDefense Mobile 4.3 User Guide 1-1

8 Getting Started AirDefense Mobile allows you to scan any a/b/g channels, regardless of country settings, and has a simple, intuitive user interface that can integrate with AirDefense Enterprise. First Time Startup The first time you start up AirDefense Mobile, you are prompted for a License Key. You must have a valid License Key to use the software. Enter the License Key and click <OK>. After entering the License Key, the Select Location window displays. This is where you select a location to scan. Anytime you start up AirDefense Mobile, the software automatically collects and lists any locations that were previously added. For first-time startups, only the default local and default Enterprise locations appear in the list. To get things started, select one of the default locations. Later on you can add other locations to scan. 1-2 AirDefense Mobile 4.3 Installation Guide

9 Getting Started Click <OK>. You are prompted to start scanning. Click <Yes> to start scanning. To scan Enterprise locations, you must set your server options to log into the server. Go to Options > Enterprise to connect AirDefense Mobile to the selected AirDefense Enterprise Server. Details for the Enterprise option are provided later in Chapter 4, Tools. Note: You must be a registered AirDefense Web User on the AirDefense Server, and possess a valid password. (Please ask your AirDefense Enterprise Administrator for a password if you do not already have one.) Local Scanning When operating locally, AirDefense Mobile auto-discovers, identifies, and monitors all a/b/g devices and their activities within the broadcast range of its network adapter card. AirDefense Mobile provides a real-time snapshot of all a/b/g wireless infrastructure, including: Wireless LAN Security Rogue Access Point and Device Detection Real Time Device Discovery and Connection Analysis Live View and streaming decodes for Traffic analysis Location Tracking Wireless Network Usage and Health Real-time Reporting. Remote (Enterprise) Scanning You can switch AirDefense Mobile from local scan to Enterprise scan, enabling the program to synchronize with AirDefense Enterprise. This gives you the ability to download all of the devices seen in a specific location by the Enterprise software, including all of the alarms for these devices that occurred in the previous minutes, hours, or days you specify. AirDefense Mobile is able to connect to any AirDefense Server and receive: A static list of authorized wireless devices scanned by AirDefense Enterprise at the remote location A static list of rogues, including rogue details, scanned by AirDefense Enterprise at the remote location. AirDefense Personal Lite Quick Start Guide 1-3

10 Getting Started AirDefense Mobile receives a snapshot of all authorized and rogue devices scanned at the Enterprise location, including: Alarms and alarm details Device Types Threat Levels. 1-4 AirDefense Mobile 4.3 Installation Guide

11 Chapter 2. Controls AirDefense Mobile provides control areas for program access and navigation. Some controls give you multiple ways to complete the same task. Program Area Select Location Control Panels Status Bar Pull-Down Menu Right-click Tools Navigation Trees Use Use this to select a scanning Location for the current AirDefense Mobile session. Your choices are Local or Enterprise. You can also use this to add new locations. Use this for instant access to AirDefense Mobile programs, tools, and filters. Use this to view Start Time, Current Time, Location, and User ID. Use this to start and stop scanning, adjust system beeps, link directly to AirDefense Mobile programs and tools, or access online Help. Use this to select a specific Access Point or Station in the Navigation Tree or in information panels and link directly to tools. Use this to link directly to information about a specific device being scanned. Select Location Select Location is used to select a different scanning location. Click File > Switch Location to display the Select Location window. Hint: When you change Locations using the Pull-Down Menu, you will lose all collected information for the current session. Select Location allows you to select either a local scanning location, or a remote (Enterprise) scanning location for your AirDefense Mobile session. The location you choose determines the information that displays in Navigation Trees and panels throughout the program. You can also use Select Location to add or delete locations. (You cannot delete a location that is currently being scanned.) Once you add a new scanning location to AirDefense Mobile, the program retains the options you configure for that location. AirDefense Mobile 4.3 User Guide 2-1

12 Controls Control Panels The control panels give you instant access to AirDefense Mobile programs, tools, and filters. There are four different control panels. The one you see depends on the scanning location that you selected. Control Panel, Local Scanning Enabled Control Panel, Local Scanning Disabled Control Panel, Enterprise Mode with Local Scanning Enabled Control Panel, Enterprise Mode with Local Scanning Disabled Click on a program button to go to an AirDefense Mobile program area. The buttons represent the primary AirDefense Mobile features. Button Program Rogue Clicking the <Rogue> button will display a list of unauthorized devices seen by the AirDefense Enterprise solution in the area (Enterprise mode only). The devices are sorted by threat level. Dashboard Clicking the <Dashboard> button displays a series of information panels that provide an overview of wireless activity in your selected scanning location (Local or Enterprise). Typical information includes: AP Count Station Count AD Hoc Count Alarm Count Operational View Signal Strength by Channel Devices by Protocol (pie chart) Frames & Bytes Event Messages Top 5 (bar graphs) Security View Security Events over time Intrusion Threats Station Behavioral Threat Chart 2-2 AirDefense Mobile 4.3 User Guide

13 Controls Button Event Messages Devices by Threat Level. Program Threats Clicking on the <Threats> button displays a panel that shows all of the alarms generated by AirDefense Mobile. In Enterprise mode it will also show all of the downloaded alarms for the location. Access Points Clicking the <Access Pts> button displays information panels for each Access Point in your selected scanning location (Local or Enterprise). Typical information includes: Access Points Selected AP General Information Access Point Detail (Data Rate, Control Management Data, and Layer 2 Data) Associated Station Detail An additional panel accessed through the Navigation Tree Discovered APs. Stations Clicking the <Stations> button displays information about each Station in your selected scanning Location (Local or Enterprise). Typical information includes: Stations Selected Station General Information Station Detail (Data Rate, Control Management Data, and Layer 2 Data) An additional panel accessed through the Navigation Tree Discovered Stations. Channels Clicking the <Channels> button displays panels with information about the channel activity in your selected scanning Location (Local or Enterprise). Typical information includes: Signal Strength/Noise by Channel Frames/Bytes by Channel CRC Errors by Channel Using the hierarchical Tree, you can display two additional panels: Selected Channel General Information Channel Detail. Ad Hoc Clicking the <Ad Hoc> button displays panels with information about the Ad Hoc activity in your selected scanning Location (Local or Enterprise). AirDefense Mobile 4.3 User Guide 2-3

14 Controls Button Program Live View Clicking the <Live View> button allows you to see the details and packet decodes for devices being scanned locally by AirDefense Mobile. You can filter the details and packet decodes by protocol, channel, or device. Note: Live View is not available when scanning an Enterprise location unless you start a local scan. Reports Clicking the <Reports> button displays AirDefense Mobile reports where you can save or print the reports. You have the option of saving one report or all the reports. Reports categories are: Devices (6 reports) Security Risks (7 reports) Performance (4 reports) Options Clicking the <Options> button allows you to: Set display options Configure channel settings Configure capture packets for archiving Add new vendor MAC addresses Configure Enterprise Server Locations Set options for downloading rogue information from Enterprise Locations Set ping options Define notification settings Change alarm settings and thresholds. Locate Clicking the <Locate> button allows you to locate a specific device being scanned locally by AirDefense Mobile. Note: Locate is not available when scanning an Enterprise Location. Diagnostic Tools Clicking the <Diagnostics> button accesses a tool that you can use to aid in security auditing and in resolving operational support issues. Diagnostic tools can help pinpoint end-to-end performance problems and determine if the wireless LAN is causing the issue. The tool includes: Ladder Connection Tool DHCP Ping TraceRoute. Using the Diagnostic Tools automatically stops AirDefense Mobile from scanning the airwaves. Scanning will begin again when you exit the tool. 2-4 AirDefense Mobile 4.3 User Guide

15 Controls Show Fields Show fields enable you to limit (filter) the devices that appear in the information panels and tree. You can limit by Device, by Session, or by Signal Strength. Field Devices Time Signal Strength Explanation These selections limit the devices that appear in the information panels to: All Devices (default) Authorized Devices Unauthorized Devices Unknown Devices Ignored Devices Adhoc Devices Scanned Devices These selections limit the devices that appear in the information panels and tree to: All Devices Seen this Session (default) Seen in the Last 1 Min. Seen in the Last 2 Min. Seen in the Last 5 Min. Seen in the Last 10 Min. Seen in the Last 15 Min. These selections limit the devices that appear in the information panels to those with specific signal strengths. You can select All signal strengths (default), or any specific signal strength that is =>, >, =, <=, or < than any integer you enter into the number field. Example: The example below shows filtering for a signal strength that is less than -40dBm. Tree These selections change what is seen in the tree. Your choices are: Protocol Channel SSID AirDefense Mobile 4.3 User Guide 2-5

16 Controls Status Bar The Status Bar displays the following: Start Time This is the time you started a AirDefense Mobile session, in 12- hour format. (HH:MM:SS AM/PM). Current Time This is the current system time, in 12-hour format (HH:MM:SS AM/PM). The current time is based on the setting of your AirDefense Mobile laptop. Loc (Location) This is the user-selected location of the AirDefense Mobile laptop. User This is the user designation for the AirDefense Mobile laptop. The left side of the Status Bar displays the channel that AirDefense Mobile is currently scanning. Pull-down Menu The pull-down menu has four control areas: File View Tools Location Tracking System Help. To use the menu: 1. Place your mouse over the desired category. 2. Left click to pull-down the selections. 3. Left click again on the desired selection. 2-6 AirDefense Mobile 4.3 User Guide

17 Controls File Selection Scan Switch Location Playback Beep on Locate Beep on New Device Exit Click this to New: Clear all collected data and begin a new scan. Hint: Using New Scan prevents you from having to close and restart the program before you can monitor another location. Start: Begin AirDefense Mobile scanning. Stop: Stop AirDefense Mobile scanning. Clear all collected data and begin scanning from a new location. Clicking this displays the Select Location screen. Playback sessions enable you to load the data from captured files into the AirDefense Mobile Navigation Tree and data panels. When the data loads, it supersedes all currently scanned data. New: Select a new captured file. Use the Open window to browse to the location of the desired capture (.apc) file. Also see Options>Packet Capture. Start: Start loading a previously selected captured file. Stop: Stop loading a previously selected captured file. Restart: Restart after stopping. Activates a beeping sound when AirDefense Mobile locates a device. Activates a beeping sound when AirDefense Mobile detects a new device. Exits AirDefense Mobile. AirDefense Mobile 4.3 User Guide 2-7

18 Controls View These selections are the same as the major program buttons on the Control Panel. Selection Dashboard Threats AP Stations Channels Ad Hoc Rogues Click this to Go to the Dashboard program area. Hint: Clicking on the <Dashboard> button in the Control Panel achieves the same result. Go to the Threats program area. Hint: Clicking on the <Threats> button in the Control Panel achieves the same result. Go to the Access Points program area. Hint: Clicking on the <Access Points> button in the Control Panel achieves the same result. Go to the Stations program area. Hint: Clicking on the <Stations> button in the Control Panel achieves the same result. Go to the Channels program area. Hint: Clicking on the <Channels> button in the Control Panel achieves the same result. Go to the Ad Hoc program area. Hint: Clicking on the <Ad Hoc> button in the Control Panel achieves the same result. Go to the Rogues program area. Rogue is only available when scanning an Enterprise Location. Hint: Clicking on the <Rogue> button on in the Control Panel achieves the same result. Tools Selection Live View Diagnostic Tools Start Packet Capture to Disk AirDefense Survey Click this to Go to the Live View tool. Note: Live View is not available when scanning an Enterprise Location unless a local scan is started. Go to the Diagnostic Tools. Start a packet capture. This is a shortcut to using the Packet Capture utility in the Options tools. This tool launches the AirDefense Survey tool. It will be grayed out if we do not detect the product is installed. 2-8 AirDefense Mobile 4.3 User Guide

19 Controls Selection AirDefense Architect Ekahau Site Survey Synchronize Authorized Devices Update Rogues Capture File Maintenance Reports Ping Unauthorized Devices Click this to This tool launches the AirDefense Architect tool. It will be grayed out if we do not detect the product is installed. Launch the Ekahau Site Survey program. This action disables AirDefense Mobile wireless scanning. This tool is for use with the Ekahau Site Survey software. It allows you to use your AirDefense Mobile laptop to perform site surveys of your network. Refresh information from authorized devices during an Enterprise scan. Note: Synchronize Authorized Devices is only available when scanning an Enterprise Location. Update rogue data in AirDefense Mobile. This updates your Rogue Devices and Rogue Details panels. Note: Update Rogues is only available when scanning an Enterprise Location. Access captured files that have been saved to your local computer. You can delete, convert files to TCPDump PCAP format or launch the capture file in Ethereal (if installed). Go to the Reports tool. This tool will try to connect to all of the unauthorized APs and then ping a specific network address that you specified under the Options page. This action disables AirDefense Mobile wireless scanning. AirDefense Mobile 4.3 User Guide 2-9

20 Controls Location Tracking Selection Locate Device Advanced Location Tracking Plan Management Click this to Go to the Locate tool. You must select the device before selecting this option. Displays the Select Floor Plan window where you can view specific information about a device. You must select the device before selecting this option. Allows you to add or delete floor plans. System Selection Options Import Export Test View Audit Log Click this to Go to the Options tools. Import Access Points (APs) or Stations from a.csv format file. Note: See Appendix A for the CSV file format. Export Access Points (APs) or Stations discovered into a.csv format file. Note: See Appendix A for the CSV file format. This tool sends a test to make sure you have set up the notification system successfully. This screen shows all of the actions performed on the system and the times they happened. Help Selection Upgrade License Help Topics About AirDefense Mobile Click this to Upgrade your AirDefense Mobile license (enter a new license key). Beginning with Release 2.5, licensing is not dependent on MAC addresses, but instead, based on User Name. Access the AirDefense Mobile Online Help System. Display current AirDefense Mobile Version and License information AirDefense Mobile 4.3 User Guide

21 Controls Right-Click Tools Menu AirDefense Mobile provides two right-click tool menus that enable you to select an Access Point or Station to change the status of a device and to link directly to a number of tools. You can: Right-click on a device in the Navigation Tree Right-click on a device that appears in any program information panel. Statuses Tools Authorize Unauthorize Ignore Unknown Edit Locate Track Device Live View Details Alarms Threat Index Clear Alarms Filter Alarms To use the Right-Click Tools menu: 1. Place your mouse over the desired device, in either the Navigation Tree or in program panels. 2. Left click to select the device. 3. Right-click to access the Right-Click Tools Menu. 4. Left-click on the desired tool. AirDefense Mobile 4.3 User Guide 2-11

22 Controls Navigation Tree Right-Click Right-click this Authorize Unauthorize Ignore Unknown Edit Locate Track Device Live View Details Threat Index Clear Alarms Filter Alarms To go directly to Authorizes a device in your wireless LAN. Unauthorizes a device in your wireless LAN. Tells AirDefense Mobile to ignore a device. Assigns a status of unknown to a device. The Edit tool. The Locate Device tool. Note: Locate is not available when scanning an Enterprise Location unless you enable local scanning. The Track Device Tool brings up the advanced location tracking application. The Live View tool. Note: Live View is not available when scanning an Enterprise Location unless you enable local scanning. Access Point Details if you selected an Access Point. Station Details if you selected a Station. Brings up the Threat Index panel for a device. Clears the alarms from the database for the specified device. Brings up the Threats panel with this device filtered on AirDefense Mobile 4.3 User Guide

23 Controls Information Panel Right-Click Right-click this Edit Locate Track Device Live View Details Threat Index Clear Alarms Show Probed SSIDs To go directly to The Edit tool. The Locate Device tool. Note: Locate is not available when scanning an Enterprise Location unless you enable local scanning. The Track Device Tool brings up the advanced location tracking application. The Live View tool. Note: Live View is not available when scanning an Enterprise Location unless you enable local scanning. Access Point Details if you selected an Access Point. Station Details if you selected a Station. Brings up the Threat Index panel for this device. Clears the alarms from the database for this device only. Lists all the probed SSIDs. Navigation Trees You can use the Navigation Trees as a shortcut tool to view data about specific devices. There are four different tree views: Protocol Channel SSID Rogue (visible while scanning an Enterprise Location only) The Navigation Trees display all devices that AirDefense Mobile sees locally (within the scanning range of your AirDefense Mobile laptop) or remotely (within scanning range of the selected Enterprise location). Devices must be connected and communicating. The devices in each tree show their most recent state. AirDefense Mobile 4.3 User Guide 2-13

24 Controls Navigating to Information Panels using the Tree Using the Navigation Tree, you can go directly to the following information panels, regardless of which program area you are currently viewing. Discovered APs Discovered Stations Panel Selected AP General Information Access Point Detail Associated Station Detail Selected Station General Information Station Detail Selected Channel General Information Channel Detail Rogue To Access from the Tree From the Protocol Tree view, left-click on any protocol icon in the tree. From any tree view, left-click on any Access Point icon in the tree. From any tree view, left-click on any Station icon in the tree. From the Channel Tree view, left-click on the Channel icon. From the Rogue Tree view (Enterprise location only), left-click on any device. Using the Navigation Tree with Locate Device To use the Locate Device tool, select a device in any tree view, and then click on Locate in the toolbar. (Not available while scanning an Enterprise Location unless you enable local scanning.) 2-14 AirDefense Mobile 4.3 User Guide

25 Summary Views Chapter 3. Programs AirDefense Mobile has seven main panels that provide you with a complete summary view and detailed views of the wireless activities taking place at your scanning Location. The following table lists the summary views in AirDefense Mobile. You can access any summary view by clicking on the appropriate button. Panel Dashboard Threats Access Points Stations Channels Ad Hoc Rogue Use Use this panel to view a summary of wireless activities in your selected scanning Location (Local or Enterprise). Use this panel to view the alarms generated or downloaded from the Enterprise system (Local or Enterprise). Use this panel to view information about each Access Point in your selected scanning Location (Local or Enterprise). Use this panel to view information about each Station in your selected scanning Location (Local or Enterprise). Use this panel to view general and detailed information about the channel activity in your selected scanning Location (Local or Enterprise). Use this panel to view general and detailed information about the Ad Hoc activity in your selected scanning Location (Local or Enterprise). Use this panel when synchronized with AirDefense Enterprise to display a list of rogue devices, at a remote location. AirDefense Mobile 4.3 User Guide 3-1

26 Programs Detailed Views The following table lists the detailed views in AirDefense Mobile. You can access detailed views by clicking on the appropriate icon in the Navigation Tree. Program Area Discovered APs and Stations Access Point Detail Station Detail Channel Detail Rogue Detail Use The Discovered APs and Stations panels display when you select a protocol from the Navigation Tree. They display only statistics on the discovered Access Points and corresponding Stations for the selected protocol. The Access Point Detail panels display when you select an Access Point from the Navigation Tree. They display only statistics about the selected Access Point. The Station Detail panels display when you select a Station from the Navigation Tree. They display only statistics about the selected Station. The Channel Detail panels display when you select a Channel from the Navigation Tree. They display only statistics about the selected Channel. While synchronized with AirDefense Enterprise, select any device in the Rogue Devices panel and right-click to display details on the rogue device. Dashboard The Dashboard display gives an overview of wireless activities taking place since you began scanning. The information that displays depends on the location you selected when you began the session and on the selections you make in the Show Fields. Local scanning displays wireless activities taking place within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. The Dashboard has two separate views available from a selection box. These are: Operations Security. Enterprise scanning displays results when you sync AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise location. This scanning displays authorized and rogue devices currently being seen by the remote AirDefense Enterprise system you selected. 3-2 AirDefense Mobile 4.3 User Guide

27 Programs Device Counts Device Counts display the number of devices being scanned. If scanning locally, this is the number of devices detected within the broadcast range of the AirDefense Mobile laptop. If scanning remotely, this is the number of devices detected by the AirDefense Enterprise Server with which your AirDefense Mobile is synchronized. If a local scan is also initiated, any other new devices seen will be appended to this number. Access Point Count Station Count Alarms Count The Access Point panel displays the number of Access Points that are being scanned, by device status. Each icon displays the number of authorized (green), unauthorized (red), Ignored (purple), and Unknown (purple with a question mark) Access Points for the protocol. A total number displays to the right of the bar. The numbers and statuses indicated by the icons coincide with the number of Access Points in the Navigation Tree. The Station Count panel displays the number of Stations being scanned. Each icon displays the number of authorized (green), unauthorized (red), Ignored (gray), Unknown (gray with question mark), and Ad Hoc Stations (yellow) for the protocol. A total number displays to the right of the bar. The numbers and statuses indicated by the icons coincide with the number of Stations in the Navigation Tree. The Alarms Count panel displays the number of alarms seen by the system (or from the Enterprise synchronization). Each icon displays the number critical (red), major (orange) and minor (green) alarms. AirDefense Mobile 4.3 User Guide 3-3

28 Programs Operations View The Operations Dashboard displays the following information panels: Signal Strength by Channel Frames & Bytes Devices by Protocol (pie chart) Top 5 (bar graphs) Event Messages. Signal Strength by Channel The Signal Strength by Channel panel displays the average signal strength in dbm of each channel being scanned, coded by color as follows: Green = Strong Yellow = Moderate Red = Weak The range is -100 to 0 dbm. Devices by Protocol The Protocol pie chart displays the percentage of devices currently broadcast for each protocol. Protocols are color coded: g (blue), b (red), and a (yellow). 3-4 AirDefense Mobile 4.3 User Guide

29 Programs Frames & Bytes by Protocol The Frames & Bytes panel displays the number of transmit bytes (blue) and transmit frames (red), by protocol. Event Messages The Event Messages panel shows all of the alarms generated by AirDefense Mobile. You can also right click on this panel to open a new window which shows all of the event messages with the ability to sort on the columns. AirDefense Mobile 4.3 User Guide 3-5

30 Programs By clicking on the column names, you can sort either numerically or alphanumerically. Clicking on the <Close> button will close the window. 3-6 AirDefense Mobile 4.3 User Guide

31 Programs Top 5 Access Points The Top 5 Access Points panel graphically displays data statistics about the five most active Access Points being scanned. MAC addresses for each Access Point display on the left. The numbers on top are for Bytes Tx and Rx. The numbers on the bottom are for Frames Tx and Rx. Both Bytes and Frames are color-coded. Top 5 Stations Top 5 Stations graphically displays data statistics about the five most active Stations being scanned. MAC addresses for each Station display on the left. The numbers on top are for Bytes Tx and Rx. The numbers on the bottom are for Frames Tx and Rx. Both Bytes and Frames are Color-coded AirDefense Mobile 4.3 User Guide 3-7

32 Programs Top 5 Channels The Top 5 Channels panel graphically displays data statistics about the five most active channels being scanned. Channel numbers display on the left. The numbers on top are for Bytes Tx. The numbers on the bottom are for Frames Tx. Both Bytes and Frames are color-coded. Security View The Security Dashboard displays the following information panels: Security Events Over time Intrusion Threat Station Behavioral Threat Chart Devices by Threat Level Event Messages. Security Events Over Time The Security Events Over Time panel graphically displays the alarms by their priority over the previous sixty minutes. Red is critical, orange is major and green is minor. 3-8 AirDefense Mobile 4.3 User Guide

33 Programs Intrusion Threat The Intrusion Threat Panel breaks down the intruding devices into four categories: DOS (Denial of Service) ID Theft (e.g. MAC address changing) Manipulation Recon (Reconnaissance). Station Behavioral Threat Chart The Station Behavioral Threat Chart shows you the percentage of stations which are either: Probing Ad Hoc Accidental. Event Messages These are the same Event Messages discussed under Operations View. AirDefense Mobile 4.3 User Guide 3-9

34 Programs Devices by Threat Level For each device AirDefense Mobile detects, it generates a threat index. This panel shows the percentage of devices at the different threat levels. Severe High Elevated Guarded Low Discovered APs & Stations The Discovered APs and Stations panels display when you select a protocol from the Navigation Tree. They display only statistics on the discovered Access Points and corresponding Stations for the selected protocol, which AirDefense Mobile has collected since scanning began. The information that displays depends on the Location you selected when you began this session, and on the selections you make in the Show Fields. Local scanning displays information on discovered Access Points and Stations that are within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise location. This scanning displays information on discovered Access Points and Stations that are currently being seen by the remote AirDefense Enterprise system you selected AirDefense Mobile 4.3 User Guide

35 Programs Discovered APs While in the Dashboard, click on the desired a, b, or g protocol icon in the Protocol Navigation Tree to display Discovered APs and corresponding Discovered Stations for that protocol. Discovered Stations Click on any header to sort from top to bottom. While in Dashboard, click on the desired a, b, or g protocol icon in the Protocol Navigation Tree to display Discovered APs and corresponding Discovered Stations. Click on any header to sort from top to bottom. AirDefense Mobile 4.3 User Guide 3-11

36 Programs Statistics The following table contains an explanation of each statistic in the Discovered APs and Discovered Stations panels: Last Seen Statistic Probing Status (Stations only) AP/Stn MAC Alias Protocol (a/b/g) SSID Channel Signal Strength Noise Encryption Authentication Explanation This is the last time this Access Point/Station was detected, in 24-hour format (HH:MM:SS). Shows a red cross mark or a green check mark. The green check mark shows that the station is currently probing out for networks. This is the MAC address of the Access Point/Station. This field displays the user alias that you can insert using the Edit utility. This confirms the protocol of the wireless device, based on your selection in the Navigation Tree. This is the Service Set Identity of the Access Point. A logical grouping of one or more Access Points, or Basic Service Set (BSS), is called an Extended Service Set, and the name that identifies the BSS is called a Service Set Identity (SSID). The SSID is a unique identifier for packets sent over the wireless LAN that allows a packet to connect to the network. Each Extended Service Set represents a wireless extension of the wired network. There is no requirement that the Access Points in an Extended Service Set be in physical proximity to each other; for example, on the same floor of a building. The grouping of Access Points into a wireless network is at the discretion of the network administrator. When a Station wishes to use the services of an Access Point, it must broadcast a probe request announcing the Extended Service Set it wishes to become a part of. The nearest Access Point in that Extended Service Set authenticates it and allows network connectivity through it. This is the channel on which the Access Point/Station is broadcasting. This is a measurement of the signal strength of the channel on which the Access Point/Station is broadcasting. This is the signal noise level of the Access Point/Station. This is the status of the WEP encryption field setting for the Access Point. Encryption. It can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the Access Point/Station AirDefense Mobile 4.3 User Guide

37 Programs Statistic Association Count (Discovered APs only) IP Address Status First Seen Advertised Rates (Discovered APs only) Vendor Comments Explanation This is the number of devices that are currently associated with the Access Point. This is the internet protocol (IP) address of the wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the Access Point/Station. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. This is the first time the Access Point/Station was detected, in 24-hour format (HH:MM:SS). These are the advertised data rates of the Access Point. This is the manufacturer of the Access Point/Station. You can use this field to insert comments, using the Edit utility. AirDefense Mobile 4.3 User Guide 3-13

38 Programs Threats The Threats panel shows you all of the alarms which AirDefense Mobile has detected since the scan started. In Enterprise mode, it will also show you all of the alarms which you have downloaded as well as any seen locally if you are also running a scan. Click on any header to sort from top to bottom. You can select any alarm by left clicking on it. Once you have selected the alarm, you can then right click on it to get the following options: By selecting Delete Alarm you can remove this alarm (all counts) from the alarm database for this location. By selecting the Show Details option, this will take you to the Threat Index page for the device which caused the alarm AirDefense Mobile 4.3 User Guide

39 Programs By selecting the Expert Help option, this will pop up a screen which gives you details about what caused the alarm and how to prevent it from happening again. AirDefense Mobile 4.3 User Guide 3-15

40 Programs Threat Index Screen The Threat Index screen brings together all of the information about an individual device on a single page, including all of the alarms generated by it. The screen also shows a threat level for the device based on the alarms generated and other details. Some of these questions have a graphical representation of them as well. The Threat Index screen can be accessed by right clicking on a device in the navigation tree and selecting Threat Index from the menu AirDefense Mobile 4.3 User Guide

41 Programs Access Points The Access Point program has two screens that provide you with the following information: A summary view that gives an overview of the activities taking place A detail view that gives more details of the activities taking place. Access Point Summary View The Access Point Summary View gives an overview of Access Point activities taking place since AirDefense Mobile began scanning. The information displayed depends on the location you selected when you began this session and on the selections you make in the Show Fields. Local scanning displays Access Point activities taking place within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise Location. This scanning displays authorized and rogue Access Points currently being seen by the remote AirDefense Enterprise system you selected. AirDefense Mobile 4.3 User Guide 3-17

42 Programs The following table describes the statistics in the Access Point panel: Statistic Explanation Last Seen This is the last time this Access Point was detected, in 24- hour format (HH:MM:SS). AP MAC Alias Protocol (a/b/g) SSID Channel Signal Strength Noise Encryption Authentication Association Count IP Address Status This is the MAC address of this Access Point. This field displays the user alias that you can insert using the Edit utility. This confirms the protocol of the wireless device, based on your selection in the Navigation Tree. This is the Service Set Identity of the Access Point. This is the channel on which the Access Point is broadcasting This is a measurement of the signal strength of the channel on which the Access Point is broadcasting. This is the signal noise level of the Access Point. This is the status of the WEP encryption field setting for the Access Point. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the Access Point. This is the number of devices that are currently associated with the Access Point. This is the internet protocol (IP) address of the wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the Access Point. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. First Seen This is the first time the Access Point was detected, in 24- hour format (HH:MM:SS). Advertised Rates These are the advertised data rates of the Access Point AirDefense Mobile 4.3 User Guide

43 Programs Statistic Explanation Vendor Comments This is the manufacturer of the Access Point. You can use this field to insert comments, using the Edit utility. Navigation Pointer Edit, Locate, Track Device, LiveView, or Details You can navigate to Edit, Locate, Track Device, LiveView, or Details directly from Access Points. Just click on any Access Point in the panel. Once the Access Point is highlighted, right-click to access the menu and then select the desired option. Access Point Detail View The Access Point Detail panels display when you select an Access Point from the Navigation Tree. They display only statistics about the selected Access Point that AirDefense Mobile has collected since scanning began. The information that displays depends on the location you selected when you began this session and on the selections you make in the Show Fields. Local scanning displays Access Point Details on a selected Access Point that is within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise Location. This displays Access Point Details on a selected authorized or rogue Access Point currently being seen by the remote AirDefense Enterprise system you selected. Statistics include: Selected AP General Information Access Point Detail displays Access Point Data Rates, Control Management Data, and Layer 2 Data Associated Station Detail To display detailed statistics on an Access Point, click on any Access Point in the Protocol, Channel or SSID Navigation Trees. Selected AP General Information The Selected AP General Information panel gives you general statistics about any single, selected Access Point. The following table describes the statistics in the Selected AP General Information panel: Statistic Explanation Last Seen This is the last time this Access Point was detected, in 24- hour format (HH:MM:SS). AP MAC This is the MAC address of the Access Point. AirDefense Mobile 4.3 User Guide 3-19

44 Programs Statistic Explanation Alias Protocol (a/b/g) SSID Channel Signal Strength Noise Encryption Authentication Association Count IP Address Status This field displays the user alias that you can insert using the Edit utility This confirms the protocol of this wireless device, based on your selection in the Navigation Tree. This is the Service Set Identity of the Access Point. This is the channel on which the Access Point is broadcasting. This is a measurement of the signal strength of the channel on which the Access Point is broadcasting. This is the signal noise level of this Access Point. This is the status of the WEP encryption field setting for this Access Point. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the Access Point. This is the number of devices that are currently associated with the Access Point. This is the internet protocol (IP) address of the wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the Access Point. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. First Seen This is the first time the Access Point was detected, in 24- hour format (HH:MM:SS). Advertised Rates Vendor Comments These are the advertised data rates of the Access Point. This is the manufacturer of the Access Point. You can use this field to insert comments, using the Edit utility AirDefense Mobile 4.3 User Guide

45 Programs Access Point Data Rates Access Points Data Rates display the data rate, bytes, frames, for the Access Point you select in the Navigation Tree. Numbers representing the Data Rate display at the bottom of the table, in Mbps. The bytes scale is on the left side of the chart, Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the right side of the table. Color coded bars representing frames display as frames received and frames transmitted. Control Management Data Control Management Data displays Control, Management, and Data bytes and frames for the Access Point you select in the Navigation Tree. The chart is divided into three categories of data, representing the type of data transmitting or receiving. The categories are Control, Management, and Data. These categories display on the left side of the chart. The bytes scale is on the top of the chart. Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the bottom of the chart. Color coded bars representing frames display as frames received and frames transmitted. AirDefense Mobile 4.3 User Guide 3-21

46 Programs Layer 2 Data Layer 2 Data displays the number of Broadcast, Multicast, and Unicast bytes and frames for the Access Point you select in the Navigation Tree. The chart is divided into three categories of Layer 2 data, representing the type of data being transmitted or received. The categories are Broadcast, Multicast, and Unicast. These categories display on the left side of the chart. The bytes scale is on the top of the chart. Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the bottom of the chart. Color coded bars representing frames display as frames received and frames transmitted. Associated Station Detail The Associated Station Detail panel displays statistics on individual Stations that have associated with a selected Access Point. The following table describes the statistics displayed in the panel: Statistic Last Seen Probing Status Stn MAC Alias Protocol (a/b/g) SSID Channel Signal Strength Explanation This is the last time the station was detected, in 24-hour format (HH:MM:SS). Shows a red cross mark or a green check mark. The green check mark shows that the station is currently probing out for networks. This is the MAC address of the station. This field displays the user alias that you can insert using the Edit utility. This confirms the protocol of the wireless device, based on your selection in the Navigation Tree. This is the Service Set Identifier of the Access Point. This is the channel on which the station is broadcasting. This is a measurement of the signal strength of the channel on which the station is broadcasting. (Maximum = 100%.) 3-22 AirDefense Mobile 4.3 User Guide

47 Programs Statistic Explanation Noise Encryption Authentication IP Address Status This is the signal noise level of the Station. This is the status of the WEP encryption field setting for the station. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the Access Point. This is the internet protocol (IP) address of the wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the Access Point. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. First Seen This is the first time the Access Point was detected, in 24- hour format (HH:MM:SS). Vendor Comments This is the manufacturer of the Access Point. You can use this field to insert comments, using the Edit utility. AirDefense Mobile 4.3 User Guide 3-23

48 Programs Stations The Stations program has two screens that provide you with the following information: Station Summary View A summary view that gives an overview of the activities taking place A detail view that gives more details of the activities taking place. The Stations panel displays an overview of Station activities taking place since AirDefense Mobile began scanning. The information that displays depends on the Location you selected when you began this session and on the selections you make in the Show Fields. Local scanning displays Station activities taking place within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise Location. This scanning displays authorized and rogue Stations currently being seen by the remote AirDefense Enterprise system you selected AirDefense Mobile 4.3 User Guide

49 Programs Statistic Last Seen Probing Status Station MAC Alias Protocol (a/b/g) SSID Channel Signal Strength Noise Encryption Authentication IP Address Status First Seen Vendor Comments Explanation This is the last time the station was detected, in 24-hour format (HH:MM:SS). Shows a red cross mark or a green check mark. The green check mark shows that the station is currently probing out for networks. This is the MAC address of the station. This field displays the user alias that you can insert using the Edit utility. This confirms the protocol of the wireless device, based on your selection in the Navigation Tree. This is the Service Set Identifier of the Access Point. This is the channel on which the station is communicating. This is a measurement of the signal strength of the channel on which the station is broadcasting. (Maximum = 100%.) This is the signal noise level of the Station. This is the status of the WEP encryption field setting for the Station. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the station. This is the internet protocol (IP) address of this wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the station. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. This is the first time the station was detected, in 24-hour format (HH:MM:SS). This is the manufacturer of the station. You can use this field to insert comments, using the Edit utility. AirDefense Mobile 4.3 User Guide 3-25

50 Programs Navigation Pointer Edit, Locate, Track Device, LiveView, or Details You can navigate to Edit, Locate, Track Device, LiveView, or Details directly from Stations. Just click on any Station in the panel. Once the Station is highlighted, right-click to access the menu and then select the desired option. Station Detail View The Station Detail panels display when you select a Station from the Navigation Tree. They display only statistics about the selected Station that AirDefense Mobile has collected since scanning began. The information that displays depends on the location you selected when you began this session, and on the selections you make in the Show Fields. Local scanning displays Station Details on a selected Station that is within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise Location. This displays Station Details on a selected Station currently being seen by the remote AirDefense Enterprise system you selected. Statistics include: Selected Station General Information Station Detail (Data Rate, Ctrl/Mgmt/Data, and Layer2) To display detailed statistics on a Station, click on any Station in the Protocol, Channel, or SSID Navigation Trees. Selected Station General Information The Selected Station General Information panel gives you general statistics about a single, selected Station. The following table describes the statistics in the Selected Station General Information panel: Statistic Last Seen Probing Status Station MAC Alias Protocol (a/b/g) SSID Channel Explanation This is the last time the station was detected, in 24-hour format (HH:MM:SS). Shows a red cross mark or a green check mark. The green check mark shows that the station is currently probing out for networks. This is the MAC address of the station. This field displays the user alias that you can insert using the Edit utility. This confirms the protocol of the wireless device, based on your selection in the Navigation Tree. This is the Service Set Identifier of the Access Point. This is the channel on which the station is communicating AirDefense Mobile 4.3 User Guide

51 Programs Statistic Signal Strength Noise Encryption Authentication IP Address Status First Seen Vendor Comments Explanation This is a measurement of the signal strength of the channel on which the station is broadcasting. (Maximum = 100%.) This is the signal noise level of the station. This is the status of the WEP encryption field setting for the station. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. This is the authentication status of the station. This is the internet protocol (IP) address of the wireless device, if available. The IP address is a numeric address that is given to a device that is connected to the internet, through which other devices and servers can find and identify the device. The IP address also applies to servers and users connected to the Internet. For servers, it is translated into a domain name, by a Domain Name Server (DNS). For users, it is assigned by the Internet Service Provider (ISP) when the user goes online. This IP address might be the same number each time you log on (called a static IP), or it might be a newly assigned number each time you connect, based on what is available. This indicates the authorization status of the station. You can change the Status by using the Edit utility. Choices are Unauthorized, Authorized, Unknown, and Ignored. This is the first time the station was detected, in 24-hour format (HH:MM:SS). This is the manufacturer of the Station You can use this field to insert comments, using the Edit utility. Station Data Rates Station Data Rates display the data rate, bytes, frames, for the Station you select in the Navigation Tree. Numbers representing the Data Rate display at the bottom of the table, in Mbps. The bytes scale is on the left side of the chart. Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the right side of the table. Color coded bars representing frames display as frames received and frames transmitted. AirDefense Mobile 4.3 User Guide 3-27

52 Programs Control Management Data Control Management Data displays Control, Management, and Data bytes and frames for the Station you select in the Navigation Tree. The chart is divided into three categories of data, representing the type of data being transmitted or received. The categories are Control, Management, and Data. These categories display on the left side of the chart. The bytes scale is on the bottom of the chart, in Mbps. Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the top of the chart. Color coded bars representing frames display as frames received and frames transmitted AirDefense Mobile 4.3 User Guide

53 Programs Layer 2 Data Layer 2 Data displays the number of Broadcast, Multicast, and Unicast bytes and frames for the Station you select in the Navigation Tree. The chart is divided into three categories of Layer 2 data, representing the type of data transmitting or receiving. The categories are Broadcast, Multicast, and Unicast. These categories display on the left side of the chart. The bytes scale is on the top of the chart. Color-coded bars representing bytes display as bytes received and bytes transmitted. The frames scale is on the bottom of the chart. Color coded bars representing frames display as frames received and frames transmitted. AirDefense Mobile 4.3 User Guide 3-29

54 Programs Channels The Channels program has two screens that provide you with the following information: A summary view that gives an overview of the activities taking place A detail view that gives more details of the activities taking place. Channel Summary View The Channels screen gives an overview of Channel activity taking place since AirDefense Mobile began scanning. The information that displays depends on the Location you selected when you began this session, and on the selections you make in the Show Fields. Local scanning displays Channel activities taking place within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise Location. This scanning displays Channel activity currently being seen by the remote AirDefense Enterprise system you selected. This screen displays information for all channels currently being scanned. There are three bar graphs: Signal Strength/Noise by Channel Frames/Bytes by Channel CRC Errors by Channel. Signal Strength/Noise by Channel The Signal Strength/Noise by Channel panel displays bar graphs that represent signal strength, and a noise level indicator. The colored bars represent the broadcast signal strength of the selected channel, in dbm. The range (left side of the panel) is -100 to 0. The Line threading through the colored bars represents the Noise level of each channel, in dbm. The range (right side of the panel) is -100 to 0. Channels are on the bottom of the panel. Note: The bars and line represent averages AirDefense Mobile 4.3 User Guide

55 Programs Frames/Bytes by Channel The Frames/Bytes by Channel panel display colored bars that represent the number of frames (red) and number of bytes (blue) broadcasted by each channel being scanned. The range for Frames is on the left side of the panel. The range for Bytes is on the right side of the panel. Channels are on the bottom of the panel. CRC Errors by Channel The CRC Errors by Channel display colored bars that represent the number of CRC Errors being broadcast by each channel being scanned. The number of errors is on the left side of the panel. Channels are on the bottom of the panel. Note: A high number of CRC errors may indicate network performance problems or an attack. Two or more Access Points may be sharing the same channel or colliding with each other. An object may be interfering with the signal, or an attacker may be flooding your air space with bad data in a Denial-of-Service attempt. AirDefense Mobile 4.3 User Guide 3-31

56 Programs Channel Detail View Channel Detail panels display when you select a Channel from the Channel Navigation Tree. They display only statistics about the selected Channel. There are two tables: Selected Channel General Information Channel Detail (Data Rate, Ctrl/Mgmt/Data/CRC, and Layer2). To display detailed statistics on a Channel, click on any Channel in the Channel Navigation Tree. General Channel Information To display Selected Channel General Information, click on a channel in the Channel in the Navigation Tree. The following table describes the statistics in the Selected Channel General Information panel: Statistic Explanation # of APs This is the number of Access Points that are using this channel. # of Stations This is the number of stations that are using this channel. Signal Strength Total Frames This is the broadcast signal strength of the selected channel, in percentage. The range is 0 to 100. This is the total number of data frames being transmitted using the selected channel. To display Channel Detail, click on a channel in the Channel view of the Navigation Tree. Data Rate The Data Rate table lists statistics for each channel being scanned. The channels are listed at the top of the table. Frames (Tx) this is the number of frames being transmitted on the channel. Frames Total this is the total frames (the combination of frames transmitted and received) on the channel. Bytes (Tx) this is the number of bytes being transmitted on the channel. Bytes Total this is the total bytes (the combination of bytes transmitted and received) on the channel AirDefense Mobile 4.3 User Guide

57 Programs Ctrl/Mgmt/Data/CRC The Ctrl/Mgmt/Data/CRC table lists statistics about the selected channel. The table displays the total number of Control, Management, and Data frames and bytes being transmitted, and breaks down each category into a percentage. The table also displays the number and percentage of CRC errors being detected. Frames (Tx) this is the number of Control, Management, and Data frames being transmitted on the channel, and the number of CRC Errors associated with Frames Tx. Frames% this is the percentage breakdown of Frames Tx. Bytes (Tx) this is the number of Control, Management, and Data bytes being transmitted on the channel, and the number of CRC Errors associated with Bytes Tx. Bytes% this is the percentage makeup of Bytes Tx. AirDefense Mobile 4.3 User Guide 3-33

58 Programs Layer 2 Data The Layer2 table lists Layer 2 statistics about the selected channel. The table displays the total number of Broadcast, Multicast, and Unicast frames and bytes being transmitted, and breaks down each category into a percentage. The table also displays the total number of each category of frames being detected. Frames Tx this is the number of Broadcast, Multicast, and Unicast frames detected on the channel, and the total number of frames for all three categories. Frames% this is the percentage breakdown of each type of Layer 2 frame. Bytes Tx this is the number of Broadcast, Multicast, and Unicast bytes detected on the channel, and the total number of bytes for all three categories. Bytes% this is the percentage breakdown of each type of Layer 2 byte AirDefense Mobile 4.3 User Guide

59 Programs Ad Hoc The Ad Hoc panel gives an overview of the Ad Hoc activities taking place since AirDefense Mobile began scanning. The information that displays depends on the location you selected when you began this session and on the selections you make in the Show Fields. Local scanning displays Ad Hoc activities taking place within the broadcast range of your mobile laptop or desktop. This scanning is limited by the range of your wireless adapter card. Enterprise scanning displays results when you synchronize AirDefense Mobile with an AirDefense Enterprise Server by choosing an Enterprise location. This scanning displays Ad Hoc activities currently being seen by the remote AirDefense Enterprise system you selected. The table following the Ad Hoc View graphic describes the statistics in the Ad Hoc panel: Statistic Network Station Channel Protocol SSID Last Seen First Seen Explanation These are the MAC addresses of Access Points that are engaged in Ad Hoc networking. These are the MAC addresses of Stations that are engaged in Ad Hoc networking. This is the channel being used by the Ad Hoc network. This is the protocol being used by the Ad Hoc network. This is the SSID to which the Ad Hoc network belongs. This is the last time this Ad Hoc network was detected, in 24-hour format (HH:MM:SS). This is the first time this Ad Hoc network was detected, in 24-hour format (HH:MM:SS). AirDefense Mobile 4.3 User Guide 3-35

60 Programs Rogue The Rogue program has two screens that provide you with the following information: Rogue Summary View A summary view that gives an overview of the activities taking place A detailed view that gives more details of the activities taking place. The Rogue panel displays information on rogue devices scanned by an AirDefense Enterprise system at a remote location. You cannot access this panel unless you are synchronized with an AirDefense Enterprise server. Once synchronized, you can access this panel by choosing the Rogue Tree option. The Rogue Tree and Rogue Devices panel display the rogue devices seen by your selected AirDefense Enterprise system in the last few minutes, hours, or days. You can specify the time filter in Options>Enterprise (see Enterprise on page 4-21). Obtain information on a specific rogue device by selecting a rogue in the Rogue Tree or Rogue Devices panel. This populates the Rogue Main panel and with data that pertains to your selection AirDefense Mobile 4.3 User Guide

61 Programs The following table describes the statistics in the Rogue panel: Item Last Seen Device MAC Type Threat Level Sensor Signal Strength First Seen Description The last time the rogue device was observed in the WLAN. The MAC address of the rogue device. The type of device (AP, Station). The threat level by number. 1. Severe 2. High 3. Elevated 4. Guarded 5. Low The MAC address of the Sensor that is detecting the rogue device. The strength of the rogue device's broadcast signal, as a percent of the maximum possible. The first time the rogue device was observed in the WLAN, in the 24-hour format HH:MM:SS. Rogue Detail View To display Selected Rogue General Information, click on a rogue in the Rogue Navigation Tree. AirDefense Mobile 4.3 User Guide 3-37

62 Programs Rogue Main Panel Item Threat Level Description Descriptors Description When you choose a device, the system assigns it a threat level and displays a color-coded icon that represents the level. The levels are as follows: Severe, High, Elevated, Guarded, Low. The color Blue represents high threat; green represents little or no threat. This is the meaning of the indicated threat level. These descriptors will indicate the connectivity, authentication, encryption, and other factors for the selected rogue device. Rogue Stats Right Side Item Access Points MAC Address Name IP Address DNS Name Vendor Name First Seen Last Seen SSID Encryption Auth Mode Channel Signal Strength Assoc Count Advertised Rates Description Color-coded icon and MAC address of the rogue Access Point. The MAC address of the rogue device. The name of the rogue Access Point, if available. The IP address of the rogue Access Point, if available. The DNS name of the rogue Access Point, if available. The vendor name of the rogue Access Point. The first time the rogue Access Point was observed in the WLAN, in the 24-hour format HH:MM:SS. The last time the rogue Access Point was observed in the WLAN, in the 24-hour format HH:MM:SS. The SSID (Service Set ID) the rogue Access Point appears under. This is the status of the WEP encryption field setting for the Station. Encryption can be either ON or OFF. Other encryption types may also be negotiated as part of the specification, but all will have the WEP field set to ON. The authentication mode, if any, the rogue Access Point is running, for example, Unknown, Open, Shared Key, LEAP, 802.1x, Other, WPA, PEAP, or AirFortress. The channel number on which the rogue Access Point was broadcasting. The strength of the broadcast signal as a percent of the maximum possible. The number stations associated with the rogue Access Point. The data rates the rogue Access Point is using AirDefense Mobile 4.3 User Guide

63 Programs Rogue Stats Bottom Area Item Priority Count Last Seen Classification Type Description AirDefense Enterprise divides alarms into the following three priorities: Critical Critical alarms are serious alarms that require immediate attention. Major Major alarms are potentially serious alarms. Minor Minor alarms suggest potential problems. AirDefense also divides alarms into Alarm Classifications and Alarm Types. The Alarm Type is the formal name that AirDefense Enterprise assigns the alarm. Each Alarm Classification consists of various Alarm Types. The alarm count. The last time this alarm was raised. The alarm classification. To make alarms easy to identify, AirDefense Enterprise groups alarms into classifications and assigns a priority to each alarm. Attack Wireless LAN traffic that indicates an external or internal attack. Policy Wireless LAN traffic that violates established or default policies for devices. Performance Wireless LAN traffic that exceeds set performance thresholds for devices. Event Unexpected changes in operation. The type of device (AP or Station). AirDefense Mobile 4.3 User Guide 3-39

64 Programs Expert Help Access Expert Help (by right-clicking on the alarm) to display detailed information about a single alarm: Priority, Cause, Effect, Remedy, and Additional Details. AirDefense Mobile provides tools that you can use to help secure and maintain your wireless LAN, and to resolve operational issues AirDefense Mobile 4.3 User Guide

65 Programs All diagnostic tools are available while you are scanning a Local location. For Enterprise scanning, the Live View and Locate tools are not available unless you start a local scan as well. Program Area Diagnostic Tools Live View Locate Device Options Use Use this tool to help in security auditing and to resolve operational issues. Use this tool to view the actual data AirDefense Mobile is detecting. Note: This tool is not available while scanning an Enterprise location unless you start a local scan as well. Use this tool to find any device being detected by AirDefense Mobile. Note: This tool is not available while scanning an Enterprise location unless you start a local scan as well. Use this tool to: Set display options Provide your AirDefense Mobile with an identity Configure channel settings Configure capture packets for archiving Configure Enterprise Server locations Set options for downloading rogue information from Enterprise locations Set ping options for unauthorized devices Set notification options and alarm settings. AirDefense Mobile 4.3 User Guide 3-41

66

67 Chapter 4. Tools Diagnostic Tools Ladder Tool AirDefense Mobile diagnostic tools can aid in security auditing and in resolving operational support issues. These tools can help pinpoint end-to-end performance problems and determine if the wireless LAN is causing the issue. The tools include: Ladder DHCP Ping TraceRoute. DHCP, Ping and TraceRoute will automatically stop the scanning. For the AP you choose, if it is using Open authentication and no encryption, it will automatically join the network. For protected networks, make sure the Windows Zero Configuration Service is running and you have the relevant authentication and security set up for this network. Scanning will begin again when you exit the tools. The Ladder tool gives you a visual representation of a client logging into an Access Point. This is the only diagnostic tool which does not perform the test locally, but instead locks the scanning channel to the AP selected and filters out login information of a specified client and aids the AP in troubleshooting problematic logins. To use the Ladder tool, do the following: 1. Choose either AP or SSID from the drop-down menu. 2. Select the Access Point or SSID you wish to try to connect to from the drop-down menu. 3. Select the Station you want to monitor connecting to the AP/SSID. 4. Click on Start. You can now wait to see the next time the station connects or you can force the station to connect on the remote station by using its wireless supplicant. AirDefense Mobile 4.3 User Guide 4-1

68 Tools The results will display as shown below. By clicking on the names of the connection ladder, you can see the details for each part of the logon. Details are shown in the Detail Message Window which automatically displays when you click a name. 4-2 AirDefense Mobile 4.3 User Guide

69 Tools DHCP Tool If an error occurs at any stage of the authentication, the name will turn red. By clicking on a name while it is red, you can see why there was an error. You can hide or display the Detail Message Window using the <Hide Detailed Message Window> or <Show Detailed Message Window> button. The <Reset> button lets you start over. The DHCP tool simulates the association of a standard network Station to the wireless LAN. Using this tool helps reveal issues, such as DHCP issues, when there is no IP address assigned to the Station. To use the DHCP tool, do the following: 1. Choose either AP or SSID from the drop-down menu. 2. Select the Access Point or SSID you wish to try to connect to from the drop down menu. 3. Click on <Associate>. This results in a DHCP acquisition of a client IP address, default gateway, and DNS server. 4. You can then optionally release and renew the IP address using the <Release> and <Renew> buttons. This will verify whether the adapter in your AirDefense Mobile laptop can correctly acquire an IP address. AirDefense Mobile 4.3 User Guide 4-3

70 Tools The following table describes the fields in the DHCP tool panel: Field AP/SSID Selector IP Address Server Lease Obtained Associate Release Review Explanation Choose either AP or SSID from the drop-down menu. Choose an AP or SSID from the drop-down selector. The IP Address should appear when you click on <Associate>. The IP address of the DNS Server should appear when you click on <Associate>. This is the date the lease was obtained, if applicable. Click this button to associate with the selected device. Click this button to release the IP address. Click this button to renew the association with the IP address. Ping Tool The Ping tool enables you to see the round trip time from a specific Access Point to another network address. 1. Choose either AP or SSID from the drop-down menu. 2. Select the Access Point or SSID from the drop-down menu that you want to associate with. 3. Enter a valid host name or IP address of the device you want to ping. 4. Click on <Ping>. 5. The results display in the panel. 4-4 AirDefense Mobile 4.3 User Guide

71 Tools Options for pinging include Retry, Timeout, Delay, and Length. The following table describes the fields in the Ping tool panel: Field Ping Host AP/SSID Selector Retry Timeout Delay Length Host RoundTT Bytes Explanation Valid host name or IP address of the network device you want your AirDefense Mobile laptop to ping. Choose either AP or SSID. Select the Access Point or SSID from the drop-down menu that you want to associate with. Changing this number alters the number of times the tool will retry a device if unsuccessful. Changing this number alters the amount of time the tool will wait for a response before initiating a retry. Changing this number alters the delay time between ping attempts. Changing this number alters the length of the Ping packet to see if larger packets take longer to reach the destination address. Host IP address. Round Trip Time. Number of data bytes transmitted and received. AirDefense Mobile 4.3 User Guide 4-5

72 Tools Field Explanation TTL Ping Total Time Lapsed. Click this button to begin pinging. TraceRoute Tool The TraceRoute tool enables you to investigate potential routing issues on the network by tracing the route between your AirDefense Mobile laptop and any host IP address or domain. To use the TraceRoute tool, do the following: 1. Choose either AP or SSID from the drop-down. 2. Select the Access Point or SSID from the drop-down menh that you want to associate with. 3. Enter a valid host name or IP address of the device you want to trace. 4. Click on Trace. Each router capable of replying to ICMP messages on the route will respond. The results display in the panel. 4-6 AirDefense Mobile 4.3 User Guide

73 Tools The following table describes the fields in the TraceRoute tool panel: Field Trace Host AP/SSID Selector Max RTT Min RTT Avg RTT Host Trace Explanation Enter a valid host name or IP address of the device or domain you want to trace. Choose either AP or SSID. Select the Access Point or SSID from the drop down that you want to associate with. Maximum round trip time. Minimum round trip time. Average round trip time. Host IP address. Click this button to begin the trace. Live View Live View Filter The Live View tool is only available during local scanning. It displays detailed, real-time view of devices that are active within the broadcast range of your laptop. Use the Live View Filter to limit the number of devices that decode. You can filter by Protocol, Channel, Device, and Frame Type. The following table describes the fields in the filter: Field Protocol Channel Device Explanation Use this to display Live View details and decoding information for a single protocol. Optionally, you can display All protocols (default). Select a protocol from the pull-down menu or leave the selector on All. Selecting a specific filter causes the Channel filter to display only channel selections that apply to the selected protocol. Use this to display Live View details and decoding information for a single channel. Optionally, you can display All channels (default). Select a channel from the pull-down menu or leave the selector on All. Channel filter displays only channel selections that apply to the selected protocol. Use this to display Live View details and decodes for a single device, by MAC address. Optionally, you can display All devices (default). Select the MAC address from one device, or leave the selector on All. AirDefense Mobile 4.3 User Guide 4-7

74 Tools Field Frame Type Explanation Use this to display a Live View details for one of the following frame types: Management Control Data. Optionally, you can display all frame types (default). Select the frame type or leave the selector on All. If you select a frame type, the Subtype and Exclude fields become active. The Subtype field allows you to limit the display further by selecting a frame subtype. The Exclude field allows you to exclude a frame type from the display by checking the checkbox. Live View Details Live View Details displays tables and graphs that represent the data activities of active devices. 4-8 AirDefense Mobile 4.3 User Guide

75 Tools The following table describes the tables and graphs: Table/Graph Frame Counts by Rate Frame Counts by Type Control Frame Types by Count Management Frame Counts by Type Data Frame Counts by Type Utilization by Rate Traffic by Rate Signal Strength Stop Live View Start Live View Close Live View Explanation This table displays data rates and the total number of frames per data rate. This table displays the total frame counts by transport method: Broadcast, Multicast, and Unicast. Broadcast, Multicast, and Unicast indicate how the frames are transported along with their source and destination. The sum of Broadcast, Multicast, and Unicast frames should equal the Frame count. This table displays the total number of frames for each type of Control Frame. (Control frames carry the data that negotiate the protocol for getting the data onto the airwaves.) This table displays the total number of frames for each type of Management Frame. (Management frames carry the data that negotiate network connections.) This table displays the total number of frames for each type of Data Frame. (Data frames carry the payload the actual data.) This chart displays the percent of utilization, broken up by the data rate of observed traffic for all devices. The colored lines represent the values per second for utilization by data rate. The numbers represent the data rate in percentage of total traffic. This chart displays the total traffic, broken up by data rate of deserved traffic for all devices. The colored lines are total byte counts of the data rate per second. The numbers represent the data rate in bytes per second. This is the broadcast signal strength of the device that sent the packet. You can change the graph by selecting a different option from the dropdown menu. The different options are: Noise Frames Traffic Broadcast, Multicast, Unicast Ctrl, Mgmt, Data Toggles between Stop Live View and Start Live View. Click this button to Stop and Start Live View Details. Click this button to close Live View. AirDefense Mobile 4.3 User Guide 4-9

76 Tools Live View Decodes Live View Decodes give you a real-time detailed view of the packets observed in your wireless LAN. Live View Decodes display only the header part of the packet, not the payload. The following table describes the fields in the Decode tab: Field Explanation Time Src Addr Dest Addr Type Sub Type Length Channel This is the time the packet was observed by AirDefense Mobile. This is the source MAC address of the device that transmitted the packet. This is the destination of the MAC address of the device that received the packet. This is the type of packet: Ctrl, Mgmt, or Data. The sub type depends on the type observed. This is the length of the frame. This is the channel on which the packet was observed by AirDefense Mobile AirDefense Mobile 4.3 User Guide

77 Tools Field Explanation Rate Signal Buffer Size Pause For Online Analysis Play For Online Display Clear Grid Prev Next Save Packets Stop Live View Start Live View Close Live View This is the data rate being used by the device that sent the packet. This is the broadcast signal strength of the device that sent the packet. The complete field name is Buffer Size For Packets Coming During Offline Analysis. You may select the following buffer sizes: (default) Toggles between the two buttons. <Pause For Online Analysis> pauses decoding so that you can do offline data analysis. <Play For Online Display> restarts Live View monitoring. Clears the grid of data. Go back to the previous highlighted packet. Go to the next highlighted packet. Click this button to save packet decodes (those displaying in the current window) to your local laptop or PC. By default, the format of the saved file is csv (comma-separated value). Toggles between Stop Live View and Start Live View. Click this button to Stop and Start Live View Details. Click this button to close Live View. AirDefense Mobile 4.3 User Guide 4-11

78 Tools Locate Device Tool The Locate Device tool is only available when local scanning is enabled. It enables you to find any device being detected by AirDefense Mobile within the broadcast range of your laptop. Locate Device is based on signal strength between the Access Point and AirDefense Mobile. To use Locate Device, you must first select a device in the Navigation Tree. The following table describes the fields in the Locate Device panel: Field MAC Address SSID Explanation This is the MAC address of the device. This address displays in the MAC address column throughout AirDefense Mobile. You cannot edit this field. This field displays the SSID of the Access Point. First Seen This is the first time AirDefense Mobile detected the device, in 24- hour format (HH:MM:SS). Alias Vendor Name This field displays the user alias that you can insert using the Edit utility. This field displays the name of the manufacturer of the device. Last Seen This is the last time AirDefense Mobile detected the device, in 24- hour format (HH:MM:SS). Signal Strength This is the signal strength of the device, measured in dbm AirDefense Mobile 4.3 User Guide

79 Tools Field Explanation Noise Signal Strength/Noise History This field indicates the level of signal noise on the broadcast channel of this device, measured in dbm. This graph indicates both signal strength and noise over a continuous period of time. A time range is displayed. Signal strength is indicated by a blue line; noise is indicated by a red line. If observe something in the graph that you want to make a note of, right-click on the graph. A popup is displayed where you can enter your note. Enter your note and then click <Save>. A line displays on the graph to indicate when the note was taken. The note along with the time and signal strength is displayed in the Notes section. You may also view the note by moving the mouse over the line. Configuration This panel is used to configure the Live View display. Field Time Range Frame Filter Frame Type Subtype Rx Traffic Tx Traffic Both Beep on Locate Lock on Channel Description Specify a time range to view. Choices are 1, 2, 5, 10, and 15 minutes. Exclude displaying frames as defined by Frame Type and Subtype. Specify a frame type that you want to view. Specify a frame subtype that you want to view. Display receiving traffic. Display transmitting traffic. Display both receiving and transmitting traffic. Laptop will beep when the device is located. When the device is located, only look for data on that channel. AirDefense Mobile 4.3 User Guide 4-13

80 Tools Field Frame Rates Live View Packet Decodes Beep on Locate Lock on Channel Close Advanced Track Explanation This panel is used to display frame rate information. Displayed are the data rate, number of frames, and a percentage of the total. This panel displays decode data (the last 1000 packets) for the selected device as it is detected by AirDefense Mobile in the broadcast range of your laptop. When operating, this panel displays the same data as you would see if you filtered for one device using the Live View tool. The Auto Scroll checkbox (when checked) automatically scrolls the decode data. If unchecked, you must use the scroll buttons to scroll the decode data. Use your mouse to place a check in the Beep on Locate radio button if you want AirDefense Mobile to sound a beep whenever it locates a packet. Place a check in the Lock on Channel box to lock AirDefense Mobile on to the currently scanned channel. Decodes will display for that channel only. Click this button to close the Locate Device window. Click this button 4-14 AirDefense Mobile 4.3 User Guide

81 Tools Options Tool Use the Options tool to: Set display options (General Settings) Configure channel settings (Channel Settings) Configure capture packets for archiving (Packet Capture also see instructions below for converting captured packets to PCAP format.) Add new vendor MAC addresses (OUI Settings) Configure Enterprise Server Locations and set options for downloading rogue information from Enterprise Locations (Enterprise) Set ping options for unauthorized APs (Ping Options) Set notification settings (Notification Settings) Set alarm settings (Alarm Settings). Highlight and click on the desired option from the available selections. Each selection has its own option screen. The following three buttons are common to all options: Button Description OK Cancel Apply Changes Click this button to apply changes to AirDefense Mobile. Click this button to end this operation without changes. Apply changes to the AirDefense Mobile database without saving. AirDefense Mobile 4.3 User Guide 4-15

82 Tools General Settings Use this option to set system preferences: The following table describes the fields in the General Settings option panel: Field Show Full MAC Address Show Garbage SSIDs Default Tree Tab Explanation Click on the checkbox to enable AirDefense Mobile to display all devices as a complete MAC address, instead of having a Vendor ID as the first six bytes. This places a checkmark in the box. (Click again to disable) Click on the checkbox to enable AirDefense Mobile to display garbage SSIDs which stations occasionally send out for. You will see these in the probing stations report. Use the drop-down selector to choose the Navigation Tree tab you want to always appear first, in the far left tab space. Choices are Protocol, Channel, or SSID 4-16 AirDefense Mobile 4.3 User Guide

83 Tools Channel Settings Use this option to set your AirDefense Mobile laptop to either scan certain channels or to lock on one particular channel. The following table describes the fields in the Channel Settings option panel: Field Information Fields Explanation Use this tool to set your AirDefense Mobile laptop to either scan certain channels or to lock on one particular channel. There are two configuration panels: b/g Select this for b/g protocol devices a Select this for a protocol devices. Enable Scan There are two choices for enabling scanning: Scan channels Scan all available channels. Lock on channel Scan a single channel. You can only lock on one channel at a time. A Channel Lock on the a protocol overrides a Channel Lock on the b/g protocol. Select Channel Scan Time If you select Scan channels, you must choose the default time to scan all channels (500 ms) or enter a duration time to apply to all channels. You can further adjust each individual channel for its own scan duration. Un-checking a channel prevents that channel from being scanned. If you select Lock on channel, you must choose a duration time for that channel from the drop-down selector. AirDefense Mobile 4.3 User Guide 4-17

84 Tools Packet Capture Use Packet Capture to enable (or disable) packet capture and to configure options for saving the captured raw-data files to your local computer. When you enable Packet Capture, AirDefense Mobile captures raw data about scanned devices. It saves these files in an AirDefense proprietary format that can then be converted by an external executable application to PCAP format (see Converting Captured AirDefense Files to PCAP). AirDefense Mobile can capture multiple packet files. The capacity is limited to ten files. When the program reaches its capacity, it starts over again, overwriting previously captured files beginning with the first file. The following table describes the fields in the Packet Capture option panel: Field Packet Capture Capture File No. of Files File Size Append Date Wrap Files Explanation Click on the checkbox to enable Packet Capture. This places a checkmark in the box. (Clicking again disables Packet Capture.) Click on the <Browse> button to define a destination path, folder and filename for the PCAP files. Select the number of sequential files that will be created before "wrapping" back to overwrite the first file. Set the maximum size per file from the File Size drop-down. The range is from small (8M) to large (128M). When you select Append Date, you can specify the name of any file written. The program appends the date to the file name of any new capture file. When you select Wrap Files, the program overwrites files after reaching the tenth file AirDefense Mobile 4.3 User Guide

85 Tools Converting Captured AirDefense Files to PCAP Once you enable Packet Capture, AirDefense Mobile captures raw data files and saves them to the destination folder and filename you specified using the Capture File field on the Packet Capture screen. You must then convert the captured AirDefense files to PCAP (Packet Capture Library) format. To convert captured packet files to PCAP format, you must use DOS commands at the operating system level, locate the application pcapconv, run the conversion, and specify the names of both the input (captured) file and the output (converted) file. Once you have converted and placed the PCAP files, you must use a program, such as Ethereal or tcpdump to read the files. Follow the steps below to convert captured packets to PCAP. 1. From your PC Start menu, select Run. 2. Type in CMD in the Run screen and click <OK>. 3. At the C:\ prompt, use the CD command to find the directory that contains the Bin folder for the AirDefense Mobile program. The location of the directory depends on where the AirDefense Mobile program is located on your specific computer. Example: c:\program files\airdefense mobile\bin 4. At the command line prompt, type <dir> to list the Bin directory. Example: c:\program files\airdefense mobile\bin>dir 5. Find the executable file pcapconv.exe in the directory. 6. Run the conversion application by typing in pcapconv.exe, followed by the name of the input file and the output file in the complete command line. (You must specify the names of both the input file, and the output file.) Example: c:\program files\airdefense mobile\bin>pcapconv.exe..\folder\packetcap.cap captureone.pcap In this example, the application program converts the input packet file packetcap.cap, and places the new PCAP file captureone.pcap into the Bin folder of the AirDefense Mobile program. The conversion application lists the number of converted packets. AirDefense Mobile 4.3 User Guide 4-19

86 Tools OUI Settings Use the OUI (organizationally unique identifier) settings to add new vendor MAC addresses to AirDefense Mobile. The following table describes the buttons in the OUI Settings option panel: Import Reset Button Explanation Click <Import> to add Vendor MAC addresses to a custom vendor file on your computer. Click <Reset> to cancel the operation without changes AirDefense Mobile 4.3 User Guide

87 Tools Enterprise This option configures the AirDefense Enterprise Server that you want to synchronize your AirDefense Mobile with. The following table describes the fields in the Enterprise option panel: Field Enterprise Server Port User Name Password Test Download Rogues seen within the last Explanation Enter the IP address or URL of the Enterprise Server. Enter the name of the Enterprise Server's communication port. Enter your valid user name for the Enterprise Server. Enter your valid user password for this AirDefense Server. Click this button to test the connectivity between your AirDefense Mobile laptop and the AirDefense Enterprise Server. If the connection is not successful, an error message appears. Use this setting to specify an elapsed time period to download rogue devices from the selected remote AirDefense Enterprise server. You can choose the number of minutes, hours, and days from the two drop-down selectors. AirDefense Mobile 4.3 User Guide 4-21

88 Tools Ping Options Use this option to configure the IP address you want to ping and the interval between tests. Note: To perform this test, the adapter will be taken out of scanning mode and will try to connect to the unauthorized APs. If those APs have any form of authentication and encryption deployed, the test will fail unless you have previously set up this information in the wireless supplicant. The following table describes the fields in the Ping Options option panel: Field Host Address Ping Host Every Explanation This is a fully qualified IP address in the format xxx.xxx.xxx.xxx. This is the number of minutes AirDefense Mobile will wait in-between tests AirDefense Mobile 4.3 User Guide

89 Tools Notification Settings Use this option to configure the notification settings you want so that you can export the alarms seen by AirDefense Mobile to a third party system via either syslog or . The following table describes the fields in the Notification Settings option panel: Field Enable Syslog IP Address Syslog Port Enable Notification Interval Address Priority Explanation Check this checkbox to enable the syslog notification system. Choose the IP address of the syslog server you want to connect to. Choose the UDP port number of the syslog server you want to connect to (Default is port UDP 514) Check this checkbox to enable the notification system. Choose the interval in which new s are created containing the alarms. Enter in the recipient address for the alarms. Check one of these checkboxes (Critical, Major, or Minor) to filter alarms of a certain type. If none are checked, then ALL alarms will be forwarded. AirDefense Mobile 4.3 User Guide 4-23

90 Tools Alarm Settings Use this option to configure the alarm settings. This allows you to enable/disable alarms and set the priority for each type of alarm. By expanding out the tree, you can drill down to individual alarms. By clicking on each alarm, you can enable/disable it, change the priority and edit the threshold if applicable. You must click <Apply> for the changes to take place. Please note that alarm settings are global in this release and not location specific AirDefense Mobile 4.3 User Guide

91 Tools Plan Management Selecting Plan Management will open up the following screen: 1. Choose your current location, and then click the <Add> button. The following window will appear: This window allows you to add in an image as a floor plan. The supported formats are JPG, GIF and BMP. 2. Click on the button to open up the file selection window. AirDefense Mobile 4.3 User Guide 4-25

92 Tools 3. Select the file you want and click on the <Open> button. This will return you to the Add Floor Plan window with the file selected. 4. You must also type in a title for the floor Plan. Once this has been done, click on <OK>. You will be asked if you want to go straight to the floor plan editor. 5. Click <Yes>. Clicking <No> will return you to the Plan Management window. The floor plan is now shown under that location. Selecting this floor plan will enable the <Edit> button. The <Edit> button allows you to change the floor plan graphic if necessary. If you change the floor plan graphic, you must go to the floor plan editor and set up the floor plan again AirDefense Mobile 4.3 User Guide

93 Tools Floor Plan Editor To access the floor plan editor, click <Yes> after adding a new image or select the floor plan under the location on the plan management screen and click the <OK> button. A popup window is displayed asking you if you want to launch the floor plan editor. Click the <Yes> button. This brings up the floor plan editor. The floor plan editor allows you to place the location on known authorized APs and to set the scale of the drawing. The toolbar down the left-hand side has the following functions: Button Function Add Device Click on this to add Access Points to the floor plan. Move Device Click on this to move devices already on the floor plan. Remove Device Click on this to delete a device on the floor plan. Fix Device Click on this to fix the devices added to the floor plan to their current location. AirDefense Mobile 4.3 User Guide 4-27

94 Tools Button Function Set Scale Allows you to set the scale of the floor plan in pixels per meter. Icon Scaling Move this to make the devices on the floor plan appear larger. Undo Undoes the last action. Redo Repeats the last action. Zoom out. Zoom in. Adjusts the label position and refreshes the screen. Select Customize Zoom (default is fit to screen) Select Device Color (default is gray). This is a global setting for the floor plan. Select Text Color (default is gray). This is a global setting for the floor plan. Adding Devices Click the <Add Device> button and then click on the location in the floor plan. A window will display allowing you to choose which device it is and where you want the label. Note: If you already have an alias for a device, it cannot be edited on this screen AirDefense Mobile 4.3 User Guide

95 Tools You can choose one of the following locations for the position field: Setting the Scale You can also change the orientation of the text from horizontal to vertical if you require. Click the <OK> button to continue. At this stage, you can move the device around the map if the location is not correct. To fix the location of the device, click the <Fix Device> button. To add more devices to the map, just start over by clicking the <Add Device> button. To set the scale, click on the <Set Scale> button. The cursor will change to a cross-hair once it is over the floor plan image. Click where you want to start the measurement and hold down the left mouse button. Move the cursor to the end of the measurement and release the button. The following screen will appear. Set the correct length in the meters box and click <Set Scale> to close. Note: Doors are often one of the easiest things to measure in terms of distance and are often very common in floor plans. Once you have completed setting up the drawing, either click File in the drop-down menu and select Save (or press Ctrl+S) to save your floor plan. AirDefense Mobile 4.3 User Guide 4-29

96 Tools Advanced Location Tracking AirDefense Mobile has a second method of location tracking for devices. Instead of using the Geiger counter approach, you can also choose to triangulate a device on a floor plan. To make sure Advanced Location Tracking is as accurate as possible, make sure that you have set up your floor plan to be as accurate as possible. On large floor plans, even small scaling errors can make a large difference. To begin Advanced Location Tracking, select a device on the navigation tree and then right-click on the device and choose Track Device. You can also select Location Tracking > Advanced Location Tracking. This displays the Select Floor Plan window AirDefense Mobile 4.3 User Guide

97 Tools Choose the floor plan you want to use and then click <OK>. The Device Tracker screen displays. When you first start the Device tracker, you will receive a reminder about how the application works. You can select the Do not remind me again checkbox if you do not want this window to appear in the future. AirDefense Mobile 4.3 User Guide 4-31

98 Tools The toolbar on the left-hand side of the window has the following functions. Button Function Zoom out. Zoom in. Turn zoom off. Stop the scan. Percentage Zoom (Default is fit to window). Scan Duration Sets the scanning time for each measurement point. (Default is 30 secs) Scale Allows you to draw a line to see how far it is. Geiger Counter Launches the Geiger counter location tracking function against the selected Device AirDefense Mobile 4.3 User Guide

99 Tools Follow these steps to begin the tracking: 1. Right-click on your current location and click on Select New Scan Point. You are asked if you want to start scanning the first point. 2. Click <Yes> to continue. A red icon will appear where you clicked and the scan will then proceed for the time duration set by the Scan Duration setting. You are then asked if you want to continue your scan and set the next scan point. 3. To continue scanning, click <Yes>. 4. Right-click on the image at your new location and click on Select New Scan point. You will now be asked if you want to start scanning the second point. AirDefense Mobile 4.3 User Guide 4-33

100 Tools 5. Click <Yes> to continue. 6. Repeat Steps 2 to 5 to start scanning the second point. You will now be asked if you want to start scanning the third point. 7. Repeat Steps 2 to 5 to start scanning the third point. After you start scanning the third point, the following window will appear. 8. Click <OK> to continue. The Device Tracker will now calculate the probable location of the Device and plot it on the floor plan AirDefense Mobile 4.3 User Guide