Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

WLAN Security Monitors: Page 5 of 31





Wireless Infrastructure Vendors at a Glance



click to enlarge

The infrastructure screen gave us a snapshot of the wireless devices. We could group and filter by status, SSID, clients associated by AP and other attributes. We also could promote rogues to known "neighbors" (devices that perhaps belong to adjoining organizations) or trusted "valid" devices and assign aliases to stations or APs.

Console information in the infrastructure view was refreshed only when sensors fed info back to our management server. Thus, constantly changing statistics, such as signal strengths weren't listed. To ferret out minutiae on rogue devices or the wireless network, we clicked on the remote GUI view, where we could connect to specific sensors and observe wireless activity in real time. No other device we tested offers this depth of information. One nit: This live aspect should be a core part of the management interface rather than in another window.

Both security and performance policies generated alerts, but we could adjust or disable most thresholds. AirMagnet supplied the most comprehensive set of policies and alarms--so many that we couldn't trigger them all. As with the other products tested, several alerts could be generated by a single event. Turning on one misconfigured AP generated a flood of alarms, from rogue AP to broadcast SSID alerts. Unfortunately, you can't view alarms by device and acknowledge just that subset.

AirMagnet's reporting capabilities are granular and complete. When we drilled past the console's chart screen, we found that AirMagnet's Reporter module could generate a multitude of Crystal-style reports. We set information to be sent to the database at the minimum interval of two hours. However, others may appreciate AirDefense's more granular and up-to-the-minute data set.

AirMagnet scored well in identifying various attack aspects, though it didn't do well at identifying software APs, opting to identify them as rogues. It also balked at alerting us every time we spoofed a MAC address. For troubleshooting, Distributed also supports packet capturing in Ethereal, Network Associates Sniffer or its own format, though on-board decodes are limited.