Rogue infrastructure access points and ad hoc networks were detected promptly and displayed in a dashboard grid. Drilling down into the rogue alarms, we noticed that though our switch was sending alarms for both 11b and 11a radios, ACS was summarizing them by BSSID and distilling both rogue radios down to one alarm. A few additional clicks revealed the whole rogue picture, but most admins would like to see all rogue activity at a quick glance.
Airespace's box, like Aruba's, tries to determine if rogues are connected directly to your wired network. But instead of relying only on Layer 2 MAC addresses to figure this out, Airespace access points spoof clients and connect to invalid access points to find out what Layer 3 IP address the access points are using, all while maintaining data connectivity for users. This measure is performed automatically, as is containment of rogue devices, unless you disable the feature.
Airespace's switch had some difficulty discovering our WLAN attacks. Without the IDS signatures needed to identify and alert admins to suspicious activity--something the company says it will include very soon--our tests triggered rogue AP, ad hoc and interference alarms when appropriate. Airespace's switch offers a little more protection when attacks are launched by clients by detecting duplicate MAC addresses and blacklisting, or shutting down, offending clients for a set time.
New to the 2.0 family of switch software is what Airespace calls WPS (Wireless Protection System). This lets companies with "No WLAN" policies shut down all wireless activity until they're ready to buy the software needed to put on the switch that will allow for the passing of data. Although some overlay monitoring tools are better suited to this task, Airespace's WPS provides a clear migration path for shops still testing the WLAN waters.
Airespace clearly sees its ability to locate access points and clients to within a 10-square-foot area as essential for battening down your airspace. Although our testing confirmed the vendor's location claims, it remains to be seen whether wireless administrators consider the ability to locate interlopers to be at least as important as specifically identifying the attacks against their WLANs.