Including or Excluding a MAC Addresses

By default, WiSentry will use a combination of WiSentry Heuristics and WiSentry Dynamic Discovery to determine if devices on your network are access points or not.  There are times that you may wish to override this logic and Include or Exclude a device based on an OUI or MAC address.

• If you have a list of authorized access points, you can add these MAC addresses into the Exclude table and they will not be reported by WiSentry.
• If you have a device that is being picked up by WiSentry heuristics but has been confirmed not to be an access point, you can add the MAC address of the device into the Exclude table and it will permanently ignored by WiSentry.  To temporarily ignore a device, select Remove an Access Point.
• If you want to include a range of devices that are not currently supported by WiSentry you can add the MAC addresses into the Include file.

F All changes to the Include and Exclude files require that the WiSentry Control Server be stopped and restarted before the changes will take effect. 

Restarting WiSentry can be accomplished in one of two methods:

1. Start the Service Control Manager (Control Panel - Administrative Tools - Services) and stop and restart the WiSentry Control Service
    
    
2. Or by restarting the machine that is running the WiSentry Control Server.

Including a Range of Devices

The include feature will allow WiSentry to report ranges of MAC addresses on your network other than those that WiSentry automatically detects.  These MAC addresses do not need to correspond to valid access points, any devices in the included MAC range will be reported on the WiSentry Administrator.

To view and edit included MAC addresses, select "View" and then "Included MAC Addresses..." from the Administrator:

Entries can be added and removed from the list by selecting the appropriate action:

MAC Address

MAC Addresses are 12-character hexadecimal numbers that include the numbers 0-9 and characters A-F. The first 6 digits of the MAC address are the vendor code, the remaining 6 digits uniquely identify a device. To include all devices within a range, use the wildcard '?' character. For instance, to include all MAC addresses that contain the vendor code 00065B, enter the following into the MAC Address field: 00065B??????.

Name

The name field can be any word that describes the device.

F Note that names cannot contain embedded spaces. 

Probability

The probability field reflects the initial probability assigned to the device when discovered. Normally, devices that have been discovered only by their MAC address will be assigned a probability of 50%, however this can be any value between 0 and 100.

Override

This value, either Yes or No, determines whether or not you want WiSentry to attempt to rule out the device when found. There are several heuristics used to determine whether or not a device is an access point and answering "Yes" to this option will allow WiSentry to adjust the probability and rule out the device. Selecting "No" will fix the given probability to the device and no attempt will be made to rule it out.

Manual Entry

Entries can also be manually added to the wisentry_include.txt file, located in the WiSentry installation directory, in the following format:

MACAddress VendorName Percentage OverridePrecentage ModelName

Example

The following example will add any devices with a MAC address starting with 00:09:99 as a WiMetrics Model Access Point with a 99% probability:

000999?????? WiMetrics 99 2 Test

F You must restart your WiSentry Control server before changes will take place.

Excluding a Range of Devices

The exclude feature is a powerful that will allow WiSentry to permanently ignore a range of MAC addresses. To exclude a device that is currently on the WiSentry Administrator display, right-click on the device and select "Exclude". (See Exclude an Access Point). To temporarily ignore a device, select Remove an Access Point.

F Excluding a MAC Address tells WiSentry to permanently ignore any device with this MAC address.  WiMetrics recommends that this feature be used sparingly as all devices in this range (including rogue access points) will not be reported in the WiSentry Administrator. 

To view and edit excluded MAC addresses, select "View" and then "Excluded MAC Addresses..." from the Administrator:

Entries can be added and removed from the list by selecting the appropriate action:

MAC Address

MAC Addresses are 12-character hexadecimal numbers that include the numbers 0-9 and characters A-F. The first 6 digits of the MAC address are the vendor code, the remaining 6 digits uniquely identify a device. To exclude all devices within a range, use the wildcard '?' character. For instance, to exclude all MAC addresses that contain the vendor code 00065B, enter the following into the MAC Address field: 00065B??????.

Name

The name field can be any word that describes the device.

F Note that names cannot contain embedded spaces. 

Manual Entry

Entries are added to the wisentry_exclude.txt file, located in the WiSentry installation directory, in the following format:

MACAddress VendorName

Example 1

The following example will ignore any devices with a MAC address starting with 00:09:99:

000999?????? TestMAC

Example 2

The following would exclude a specific device:

00045ADA443F Linksys

F You must restart the WiSentry Control server before changes will take place.

Top