Last week all of a sudden, I'm starting to see teacher laptops show up under Rogue SSID contained, all start with "direct". with the "seen on lan" message. I am whitelisting them as they come in but wonder why this started happening, Happening with the old and new firmware. No blocked rules in place and they are on wireless only, no wired connection also in use.
I ran across an old thread mentioning screen mirroring and false positives. Most machines do run Air Server to project their ipads through the laptop then projector. I can troubleshoot that by disabling air server on a few machines with the issue but we still need to use it. What seems to be happening when it captured by air marshall, it deauthenticates the user and makes them log back into our wifi.
Any ideas or suggestions? Thanks.
