Batboard

Has anyone deployed and/or worked with an AirDefense yet?

http://airdefense.net/

I attended a demonstration yesterday, and was suitably impressed with the integration of appliance and software especially from a maintenance and troubleshooting perspective. While we get a few Canopy implementations, it is a competitive market, and it is not our core competency. Quite often we are only a sub to the prime electrical contractor that will be doing the actual installation. They do all the civil. They mount the poles. They run the power. They mount the equipment. They have another sub do the layer 3 equipment. We do the coverage analysis, sell the wireless equipment, do the pre-config, and provide the support through acceptance.

There are always problems afterwards because the unlicensed bands are totally polluted in urban areas. So many people are using wireless networking products that it's impossible to find clean spectrum anywhere, and over the years I've had to cobble together a suite of tools to investigate and mitigate these problems ... not always successfully. I've also been contracted to resolve installations by other vendors that walked away from non-working systems after they have run out of ideas.

AirDefense looks like a good investment not only for a customer, but also for a service company looking to augment their bottom line with pro-active maintenance of wireless systems. I'm interested to know if anyone has successfully used AirDefense, and if my intuition is correct.

Lots of hits, and no responses which tells me nobody has played with it yet. There is chatter about it on the wi-fi boards, but no deployment stories there either. Well, a quick summary for those interested -

It is an appliance and a software solution as I said before. You have to have one of their "sensors" in order to take full advantage of it. I couldn't get specific information about the "sensor", but I gathered it is a chipset built into the latest production of Moto a/b/n AP's (access points) that lets it sniff the air, monitor traffic, or be a spectrum analyser, as well as monitor and manage the wired side of your network. It performs advanced full time VA (vulnerability assessment), and takes action based on the policies you select. They do have product that can replace your firewall appliance to act as your dhcp / gateway / router / et al as well as manage newer Moto and Cisco AP's and a limited set of modern Cisco layer 3 equipment. The gui is much better than previous Canopy devices especially the spectrum analyser. The detail it can give about traffic is amazing. Not only can it list the attached devices, but it can show which AP a mobile device is currently associated with, show which AP's that device associated with in the past, what it's demand is, what web site(s) it's visiting, etc, etc. The more you drill down, the more you can find out about an individual device on the wired or wireless sides of your system.

There are some applications that can do that already. What's different about this product is its management ability, and its automated responses to presumed threats. Again, it supports all the newer Moto products, and some Cisco product. It can deny access through a Moto or Cisco AP, or by turning ports off in a Cisco router. Fairly standard stuff. It can recognize a rogue AP in your operating environment and shut it down as opposed to an AP belonging to a business in an adjacent building that you do not want to interfere with. It can also take counter measures against unauthorized mobile devices without affecting your authorized users. Potentially a dangerous tool in the wrong hands, but an effective tool in the right hands.