Managing Discovery

Display Columns

As devices are discovered on your network, they are displayed in the WiSentry Administrator. Some devices such as consumer based access points can take up to 2 minutes to be displayed on the console. The information reported will be as follows:

• Vendor
  Vendor name of the device
• Model/Name
  This field will display one of the following (by order priority)
  • Access Point Name
  • Access Point Model
  • Probe Status
  • Non-Access Point Device Name

  The definitions for the above items are as follows: 

  • Access Point Name <User Configured Name of the Access Point if available>
  • Access Point Model <Manufacturer Model Number if available>
  • Probe Status
    • Probing... - Further probes are being run on this device
    • Not Available - After further probes have been completed, no additional information is available at this time.
  • Non-Access Point Device Name
    • Windows PC - A Windows PC with a network card in a known OUI range.  This device will roll off of the display.
    • Printer - A Printer with a network card in a known OUI range.  This device will roll off of the display.
    • Netware PC - A Netware PC with a network card in a known OUI range.  This device will roll off of the display.
    • Sun Workstation - A Sun Workstation with a network card in a known OUI range.  This device will roll off of the display.
    • Cabletron Switch - A Cabletron Switch in a known OUI range.  This device will roll off of the display.

• VLAN
  When WiSentry is used in VLAN mode, the VLAN where the access point was discovered will be displayed here.  In Standard Mode, this will be "-".
• Probability
  Based on the WiSentry heuristics (also known as probes) that have been run, this is the device probability for a given model: 
  • 85% or greater - Typically any device ending in this range will possess a number of valid probes for an access point.  These devices should be considered an immediate threat.
  • 51%-85% - Typically reported when a device possess a number of characteristics but fails one or more known heuristics for a known access point.  These devices should be considered a possible threat and investigated further. 
  • 50% or less - Typically reported for devices that exist in the same OUI range as a known access point but fail most WiSentry probes.  Typically these devices are computers behind firewalls but may also include some access points that are unknown to WiSentry.  These devices should be considered a possible threat and worth watching.
• MAC Address
  MAC Address of the device
• IP
  IP Address of the device.  When the IP address is 0.0.0.0 or blank this typically means that the device has been detected on a subnet that does not belong to the Agent or that no IP layer traffic has yet been seen by the Agent.
• Last Activity
  Time stamp of the last activity seen from the device. A device with a probability of greater than 50% will remain on the display even if it is removed from the network. Check this column to verify that a device on your display is still active on the network.

Managing the Display Entries

There are a number of options for displaying items reported in the WiSentry Administrator. 

Top