topic Monitor Mode and CleanAir in Wireless

Monitor Mode and CleanAir

Freetown — Mon, 05 Jul 2021 16:02:36 GMT

Which wireless features will help me detect wireless clients Laptop/Cell Phones even if my AP's are not servicing clients. Took a primary wireless client last week but couldn't get the answer from the class. AP's NOT servicing client (Monitor Mode) send SNMP of all wireless device Cell phone/Laptop that is seen by the Monitor Mode AP. Is this possible?

Re: Monitor Mode and CleanAir

Flavio Miranda — Tue, 28 Aug 2018 07:51:12 GMT

AP does not send snmp and even if could send, regular wireless device wouldn't understand.

The way client communicate with AP is using probes and it is based on the bssid which will not happen with AP not serving clients. So, the way I see it, itiis not t possible.

-If I helped you somehow, please, rate it as useful.-

Re: Monitor Mode and CleanAir

Freetown — Tue, 28 Aug 2018 14:45:05 GMT

Thank for your reply! I know the AP's will not send SNMP, but the WLC can.
My intention is for the Monitor Mode AP's to capture the client Probes. The
clients need to send probes to discover BSSID right? Can the Monitor Mode
AP's (MMA) capture the probe data and relay that to the WLC and then use
SNMP on the WLC to send alert to a monitoring station about the probe data
string. E.g., an apple phone or a Dell laptop is sending a probe looking for
any BSSID that it can potentially be associated with. Let say I have a room
that wireless/Bluetooth 802.11 devices are not allowed inside. "You cannot
have a wireless device in that room." I'm trying to setup a mentoring
solution using Cisco WLC and Monitor Mode AP's (MMA) to capture violations
and send alert to a monitoring station and possible track the location of
the offending device using MSC. I was able to capture the Bluetooth device
using CleanAIR, but not the wireless probes.

Re: Monitor Mode and CleanAir

Flavio Miranda — Tue, 28 Aug 2018 18:43:44 GMT

In monitor mode I don´t think so but in Sniffer more you can collect those packets and send to a server.

-If I helped you somehow, please, rate it as useful.-

Re: Monitor Mode and CleanAir

Freetown — Tue, 28 Aug 2018 18:52:05 GMT

Found this online, might be the answer or maybe somebody can elaborate:

Probe requests are 802.11 management frames sent by clients to request
information about the capabilities of
SSIDs. By default, access points forward acknowledged probe requests to the
controller for processing.
Acknowledged probe requests are probe requests for SSIDs that are supported
by the access point. If desired,
you can configure access points to forward both acknowledged and
unacknowledged probe requests to the
controller. The controller can use the information from unacknowledged probe
requests to improve the location
accuracy.