Cisco Lightweight AP Modes: Local, Monitor, Sniffer, Rogue Detector, and FlexConnect

As you probably notice, if you’ve read recent articles, APs do not just operate in one mode. They typically have multiple operations that can be used for different purposes. Today I will be discussing the different types of modes that can be used with Lightweight APs. 

1. Local Mode
2. Sniffer Mode 
3. Rogue AP Detection
4. Monitor Mode 
5. Flex Connect Mode 

Local – Local mode is the default operating mode for a lightweight AP, where the AP provides wireless access to clients and tunnels their traffic to a central WLC using the CAPWAP protocol. 

Sniffer – Sniffer mode is an operating mode in which the AP stops serving wireless clients and instead captures and monitors 802.11 wireless traffic on a specific channel. In this mode the AP functions as a “packet capture device,” collecting wireless frames and forwarding them to a network analysis tool such as wireshark for protocol analysis, diagnostics, and troubleshooting.  Since this mode is dedicated to monitoring traffic, it does not provide any client connectivity while operating in this mode. 

Rogue AP Detection – Rogue AP Detection mode is a non client serving state mode in which the AP is dedicated solely to identifying rogue APs physically connected to the wired network. Not to be confused with monitor mode, monitor scans the wireless network versus rogue AP detection which only listens to the wired network. An AP operating in rogue AP detection mode typically disables all of its radios and focuses on the wired ethernet segment. It listens to ARP traffic on the wired network and forwards seen MAC addresses to the WLC. The WLC then correlates these wired MAC addresses with MAC addresses detected wirelessly by other APs operating in monitor mode. After the correlation, the WLC can then identify rogue APs directly connected to the wired network. 

Monitor Mode – When an AP is operating in monitor mode, its radios are dedicated entirely to monitoring the RF environment rather than serving wireless clients. It does not participate in any client serving activities such as broadcasting an SSID, accepting client associations, or carrying client traffic. Instead, it spends 100 percent of its time scanning through available channels, collecting wireless intelligence and security information. Unlike rogue AP detection, its function is not limited to detecting rogue APs. Its primary functions include rogue AP detection, identifying unauthorized wireless devices, detection sources of interference, and even supporting (WIDS) wireless intrusion capabilities. WIDS on an AP operating in monitor mode can detect deauthentication attacks, spoofing attempts, and other wireless threats. 

FlexConnect – FlexConnect is an operating mode for a lightweight AP that allows client traffic to be switched locally at the AP rather than being tunneled back to the WLC. Instead of traveling all client traffic to a WLC located on another site, traffic can skip that process and go straight to the network on the same site. In this mode, the AP still maintains a control connection with the WLC for centralized management, configuration, and policy distribution, while allowing client traffic to be forwarded onto the local wired network at the remote site. Allowing local switching reduces WAN bandwidth consumption and enables clients to continue accessing local network resources or even access the internet (via local default gateway) even if connectivity to the WLC is lost. FlexConnect mode is common for a company with headquarters with branch sites where tunneling wireless traffic back to the WLC for every single frame would be inefficient and wasteful.