HPE Aruba Networking’s Wireless Intrusion Prevention (WIP) system, part of the AOS-8 architecture (Mobility Master and Mobility Controllers), is designed to detect and classify rogue APs. The "AOS Detected Radios" page provides details about detected APs, including their SSID, BSSID, and match methods used to classify them.
In this case, the AP is classified as a rogue with the following match methods:
Plus one: This indicates that the BSSID of the detected AP is numerically close (e.g., differs by one in the last octet) to the MAC address of a known device in the network.
Eth-Wired-Mac-Table: This indicates that the AP’s MAC address (or a closely related MAC address) was found in the wired network’s MAC address table, suggesting that the AP is connected to the LAN.
These match methods suggest that the AP is likely connected to the company’s wired LAN (via the Eth-Wired-Mac-Table match) and has a BSSID that is close to a known device’s MAC address (Plus one match). Since this AP is not part of the company’s authorized AP list (it’s broadcasting "PublicWiFi," which may not be a corporate SSID), it is classified as a suspected rogue. This scenario is common when an unauthorized AP is plugged into the corporate LAN, posing a security risk.
Option A, "The AP has been detected using multiple MAC addresses," is incorrect because the match methods do not indicate multiple MAC addresses; they indicate a close match to a known MAC and a presence in the wired MAC table.
Option C, "The AP is an AP that belongs to your solution," is incorrect because the AP is classified as a rogue, meaning it is not part of the authorized APs in the solution.
Option D, "The AP has a BSSID that is close to your authorized APs’ BSSIDs," is partially correct in that the "Plus one" match indicates a close BSSID, but the key reason for the rogue classification is its connection to the LAN (Eth-Wired-Mac-Table), not just the BSSID similarity.
The HPE Aruba Networking AOS-8 8.11 User Guide states:
"The Wireless Intrusion Prevention (WIP) system detects rogue APs by analyzing their BSSIDs, SSIDs, and connectivity to the wired network. The ‘Eth-Wired-Mac-Table’ match method indicates that the AP’s MAC address (or a closely related address) was found in the wired network’s MAC address table, suggesting that the AP is connected to the LAN. The ‘Plus one’ match method indicates that the AP’s BSSID is numerically close to a known MAC address in the network, which can indicate a potential rogue device attempting to mimic a legitimate device." (Page 412, Rogue AP Detection Section)
Additionally, the guide notes:
"A rogue AP is classified as ‘suspected rogue’ if it is detected on the wired network (e.g., via Eth-Wired-Mac-Table) and is not part of the authorized AP list. This often occurs when an unauthorized AP is connected to the corporate LAN." (Page 413, Rogue AP Classification Section)
[References:, HPE Aruba Networking AOS-8 8.11 User Guide, Rogue AP Detection Section, Page 412., HPE Aruba Networking AOS-8 8.11 User Guide, Rogue AP Classification Section, Page 413.===========]
