So it's not clear whether Marriott was intentionally being nasty or some over-eager CCNA just turned on all the bells and whistles he could find.
So is it a disruption feature if in effect it neutralises disruption when used correctly? As I said, it is a grey area.
> "Containment can have legal implications when launched against neighboring networks. Ensure that the rogue device is within your network and poses a security risk before you launch the containment."
The wording in the FCC Consent Decree in this case suggests that this feature would actually have been okay if it was being used against actively hostile networks:
> "Specifically, such employees had used this capability to prevent users from connecting to the Internet via their own personal Wi-Fi networks when these users did not pose a threat to the security of the Gaylord Opryland network or its guests."
It's not a technical limitation on a certain type of packets, but about the results.
The problem is only when the end result is that you are deliberately stopping other people from making valid use of the spectrum.
There are valid cases for doing what they are doing (preventing spoofing).. this just wasn't one of those valid use cases.
From the linked article it appears to only target devices attempted to spoof you by default, which is definitely not what the complaint was about.
- Rogue on Wire - If a rogue device is identified to be attached to the wired network, then it is automatically placed under containment.
- Using our SSID - If a rogue device is using an SSID which is the same as that configured on the controller, it is automatically contained. This feature aims to address a honey-pot attack before it causes damage.
- Valid client on Rogue AP - If a client listed in ACS is found to be associated with a rogue device, containment is launched against that client only, preventing it from associating to any non-managed AP.
- AdHoc Rogue AP - If an ad-hoc network is discovered, it is automatically contained.
The kind of blocking in question here sounds more aggressive than any of these categories. Though it's certainly possible they were using some other vendor's gear which has additional options.
One of the important issues here is that wireless communication doesn't respect boundaries. It seems they could have easily been interfering with networks on neighboring properties.
I don't think so. This mode targets ad hoc networks. Mifi devices and iPhone/Android tethering set up access points, not ad hoc networks.