Troubleshooting Tip: Troubleshooting a rogue not matching any device profiles

[cmaheu]

Description

This article describes how to troubleshoot a rogue connected to the network which does not match any of the configured Device Profiling Rules. 

Scope

Version: 9.x & F7.x.

Solution

1. Navigate to Users & Hosts -> Hosts.
2. Search for the MAC address and verify the rogue's adapter record status shows online (green adapter icon).

Adapter record shows offline:  Check switch or wireless connection.  If device is confirmed to be online, see these related articles:

• Technical Note: Online wireless hosts displaying offline status.
• Technical Note: Wired hosts displaying incorrect status.

If the adapter record shows online: Right-click on the Host record and select Show Events.

'Invalid Physical Address' means the corresponding Vendor OUI is not in the database.  For troubleshooting steps, see related article Technical Tip: Host fails to register or multiple host records are created.

'Device Profiling Rule Missing Data' means the Device Profiler cannot compare a rogue against a rule because there is not enough information about the rogue.  For troubleshooting steps, see related article Technical Note: Troubleshooting 'Device Profiling Rule Missing Data' events.

Revalidate:

1. After making corrections, test the rogue against the desired rule.  Search for the MAC address in Users & Hosts -> Adapters.
2. Right-click on the adapter record and select Test Device Profiling Rule.
3. Once the rule matches, right click on the adapter record and select Reprofile Rogue(s) to re-run the evaluation for the adapter.

If rogue now matches the wrong rule, see related article Technical Tip: Troubleshooting rogue matching the wrong device profile.