Viewing Detected Client Pre-Authentication History; Figure 343: Detected Client Pre-Authentication History; Table 319: Wids Client Rogue Classification - D-Link DWS-4026 User Manual

D-Link Unified Access System
Field
MAC Address
Test Description
Condition Detected
Reporting MAC
Address
Radio
Test Config
Test Result
Time Since First Report
Time Since Last Report

Viewing Detected Client Pre-Authentication History

To help authenticated clients roam without losing sessions and needing to re-authenticate, wireless clients can attempt to
authenticate to other APs within range that the client could possibly associate with. For successful pre-authentication, the
target AP must have a VAP with an SSID and security configuration that matches that of the client, including MAC
authentication, encryption method, and pre-shared key or RADIUS parameters. The the AP that the client is associated with
captures all pre-authentication requests and sends them to the switch.
The Detected Client Pre-Authentication History page shows information about the pre-authentication requests that the
detected client has made.
Table 320 describes the fields on the Detected Client Pre-Authentication History page.
Page 498 Monitoring and Managing Intrusion Detection

Table 319: WIDS Client Rogue Classification

Description
The Ethernet MAC address of the detected wireless client.
Identifies the tests that were performed, which includes the following:
• Client is not listed in the Known Clients database.
• Client exceeds the configured rate for transmitting 802.11 authentication requests.
• Client exceeds the configured rate for transmitting probe requests.
• Client exceeds the configured rate for transmitting de-authentication requests.
• Client exceeds the maximum number of failing authentications.
• Known Client is authenticated with an Unknown AP.
Indicates whether the result of the test was true or false.
Identifies the MAC address of the AP that reported the test results.
Identifies which physical radio on the reporting AP was responsible for the test results.
Shows whether this test is configured to report rogues. Each test can be globally enabled or
disabled to report a positive result as a rogue.
Shows whether this test reported the device as rogue. In some cases the test may report a
positive result, be enabled, but not report the device as rogue because the device is allowed
to operate in this mode.
Time stamp indicating how long ago this test first detected the condition.
Time stamp indicating how long ago this test last detected the condition.

Figure 343: Detected Client Pre-Authentication History

Software User Manual
Document 34CSFP6XXUWS-SWUM100-D7
12/10/09