AP SSID Changed

What is an SSID?

Each set of wireless devices communicating directly with each other is called a basic service set (BSS). Several BSSs can be joined together to form one logical WLAN segment, referred to as an extended service set (ESS). A Service Set Identifier (SSID) is simply the 1-32 byte alphanumeric name given to each ESS.
For example, a departmental WLAN (ESS) may consist of 2 access points (APs) and dozens of stations, all using the same SSID. Another organization in the same building may operate its own departmental WLAN, composed of 5 APs and several stations using a different SSID. The purpose of SSID is to help stations in department A find and connect to APs in department A, ignoring APs belonging to department B.

What if SSID is changed?

As SSID is the 'entry point' of the wireless network, it has to be configured properly as it can open up the entire network to attackers if not configured properly. A change in SSID could mean any of the following:

• WLAN administrator has configured the AP to use a different SSID (legitimate)
• An attacker has gained access to the AP configuration interface and has changed the SSID (illegitimate)
• An attacker is masquerading as a legitimate AP

How WiFi Manager handles SSID change?

WiFi Manager monitors every SSID change and alerts the WLAN administrator using alarms. Every alarm will carry the newly configured SSID and the AP on which the change occurred. WiFi Manager then compares the newly configured SSID with the authorized SSID list. If the SSID does not match the ones in enterprise authorized SSID list, WiFi Manager alerts the operator through another alarm. Any AP with an SSID that is not covered in the authorized SSID list would mean that the AP might be a Rogue AP.

Upon receipt of these alarms, administrators can quickly check the configuration history page (a feature in WiFi Manager that logs all configuration operations carried out from WiFi Manager to the APs) to identify who carried out the change.