< Home

display wlan ids contain

Function

The display wlan ids contain command displays information about countered devices.

Format

display wlan ids contain { all | ap | adhoc | client | ssid | mac-address mac-address | monitor-ap { ap-name ap-name | ap-id ap-id } [ radio-id radio-id ] }

Parameters

Parameter

Description

Value

all

Displays information about all countered devices.

-

ap

Displays information about countered APs.

-

adhoc

Displays information about countered ad-hoc devices.

-

client

Displays information about countered user terminals.

-

ssid

Displays information about countered devices with unauthorized SSIDs.

-

mac-address mac-address

Displays information about countered devices with specified MAC addresses.

The MAC addresses must exist.

monitor-ap ap-name ap-name

Displays information about countered devices that are detected by the AP with a specified name.

The AP name must exist.

monitor-ap ap-id ap-id

Displays information about countered devices that are detected by the AP with a specified ID.

The AP ID must exist.

monitor-ap { ap-name ap-name | ap-id ap-id } radio-id radio-id

Displays information about countered devices that are detected by the radio with a specified ID on a specified AP.

The radio ID must exist on the AP.

Views

All views

Default Level

1: Monitoring level

Usage Guidelines

After WIDS or WIPS is enabled, you can run the display wlan ids countermeasures device command to view information about countered devices.

Example

# Display the list of all countered devices.

<HUAWEI> display wlan ids contain all
#Rf: Number of monitor radios that have contained the device
CH: Channel number
-------------------------------------------------------------------------------
MAC address      CH  Authentication   Last detected time   #Rf   Reason   SSID
-------------------------------------------------------------------------------
88e3-abbf-b93d   11  open             2014-11-20/16:16:57  1     manual     -
-------------------------------------------------------------------------------
Total: 1, printed: 1
Table 1 Description of the display wlan ids contain all command output

Item

Description

MAC address

MAC address of the countered device.

CH

Channel in which the monitoring AP detects a device for the last time.

Authentication

Authentication mode of the countered device.

Last detected time

Last time at which the monitoring AP detects a device.

#Rf

Number of monitor radios that have contained the device.

Reason

Reason for the device to be contained. The priorities of containment reasons are in descending order as follows: manual > open-encrypt > spoof-ap > protect-client > client > adhoc.

SSID

SSID of the countered device.

# Display information about countered SSIDs.

<HUAWEI> display wlan ids contain ssid
#Dev: Number of devices using SSID
----------------------------------------------------------------------
 SSID                              #Dev     Last detected time     
----------------------------------------------------------------------
 CMCC                              2        2012-07-27/16:41:55    
----------------------------------------------------------------------
Total: 1, printed: 1
Table 2 Description of the display wlan ids contain ssid command output

Item

Description

SSID

Countered SSID.

#Dev

Number of devices that use the SSID.

Last detected time

Last time at which the device using the SSID is detected.

# Display information about countered devices with specified MAC addresses.

<HUAWEI> display wlan ids contain mac-address 549f-13c4-627f
-------------------------------------------------------------------------------
MAC address                                             : 549f-13c4-627f
BSSID                                                   : dcd2-fc9a-c808
Type                                                    : rogue client
SSID                                                    : -
Authentication                                          : -
Number of monitor radios that have contained the device : 1
Last detected channel                                   : 1
Maximum RSSI(dBm)                                       : -54
Beacon interval(ms)                                     : 0
First detected time                                     : 2015-10-20/15:06:26

Reported AP 1  AP name                                                : admin_ap0_admin_ap0_admin
 Radio ID                                               : 0
 MAC address                                            : dcd2-fc1e-c4a0
 Radio type                                             : 802.11bg
 Channel                                                : 1
 RSSI(dBm)                                              : -54
 Last detected time                                     : 2015-10-20/15:06:26
 Counter measure                                        : Y
 Reason                                                 : manual
-------------------------------------------------------------------------------
Table 3 Description of the display wlan ids contain mac-address command output

Item

Description

MAC address

MAC address of the detected device.

BSSID

BSSID of the detected device.

Type

Type of the detected device.

SSID

SSID of the detected device.

Authentication

Authentication mode of the detected device.

Number of monitor radios that have contained the device

Number of radios that contain the device.

If WIDS is enabled on multiple APs, the type of the device may be contained by these APs' radios.

Last detected channel

Channel in which the device is detected for the last time.

Maximum RSSI(dBm)

Maximum RSSI of the detected device.

Beacon interval(ms)

Interval at which the detected device sends beacon frames.

First detected time

First time at which the device is detected.

Reported AP 1

Information of the Monitoring AP which reports detection information.

AP name

Name of the monitoring AP.

Radio ID

Radio ID of the monitoring AP.

MAC address

MAC address of the monitoring AP.

Radio type

Radio type of the monitoring AP.

Channel

Channel of the monitoring AP.

RSSI(dBm)

RSSI of the monitoring AP.

Last detected time

Last time when the device is detected.

Counter measure

Whether the device is contained.

Reason

Reason for the device to be contained. The priorities of containment reasons are in descending order as follows: manual > open-encrypt > spoof-ap > protect-client > client > adhoc.

# Display the list of countered devices among the wireless devices detected by the monitoring AP huawei.

<HUAWEI> display wlan ids contain monitor-ap ap-name huawei
Countermeasures Device Profile 
--------------------------------------------------------------------------------
AP MAC address                                : dcd2-fc1e-c4a0 
AP type                                       : AP5030DN 
AP name                                       : huawei
Contain device 0
  MAC address                                  : c46a-b7bc-7b83
  BSSID                                        : 0006-f476-e210
  Type                                         : rogue client
  SSID                                         : -
  Authentication                               : -
  Last detected channel by this AP             : 1
  Maximum RSSI(dBm)                            : -71
  Beacon interval()                          : 0
  First detected time                          : 2015-10-20/15:06:26
  Reason                                       : manual
--------------------------------------------------------------------------------
Total: 1, printed: 1
Table 4 Description of the display wlan ids contain monitor-ap command output

Item

Description

AP MAC address

MAC address of the monitoring AP.

AP type

Type of the monitoring AP.

AP name

Name of the monitoring AP.

MAC address

MAC address of the countered device.

BSSID

BSSID of the countered device.

Type

Type of the countered device.

SSID

SSID of the countered device.

Authentication

Authentication mode of the countered device.

Last detected channel by this AP

Channel in which the monitoring AP detects a countered device for the last time.

Maximum RSSI(dBm)

Maximum RSSI of the countered device.

Beacon interval()

Interval at which the countered device sends beacon frames.

First detected time

First time at which the device is detected.

Reason

Reason for the device to be contained. The priorities of containment reasons are in descending order as follows: manual > open-encrypt > spoof-ap > protect-client > client > adhoc.

Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >