Very interesting point. A Cisco page[1] discussing this feature says:

"Containment can have legal implications when launched against neighboring networks. Ensure that the rogue device is within your network and poses a security risk before you launch the containment."

[1]http://www.cisco.com/c/en/us/support/docs/wireless/4400-seri...

Cisco seems to think this is perfectly fine to do to rouge APs connected to an organization's wired network, however.

Note that the Marriott enforcement action concerned the use of personal access points not connected to a Marriott network.

I don't see any basis in the Communication Act for making this distinction though. 47 U.S.C. Section 333, the law Marriott violated, says: "No person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government." From the Cisco materials mentioned above, it seems the mitigation method involves sending fake de-authentication packets over the air. That also seems like intentional interference to me!

It's clear from the memo that the FCC considers security risks to be exempt from this requirement.

It sounds like the AP being on your network is what constitutes the security risk. I doubt the FCC would have a problem with a network administrator taking action like that. Unrelated APs are different.

It's also arguably not "harmful interference"... it's a legitimate operation within your network.

Yeah, big difference between limiting access to your own network and limiting access to someone else's

The link escapes me now but isn't this what Marriott is claiming?

thers a diference between a rogue ap atached to your DS (distribution system) and a rogue client device.

Aren't jamming devices of that type illegal, as discussed elsewhere in the thread? And isn't what Cisco is doing by even manufacturing a device with that capability illegal, or at least cause for the FCC to ban its sales in the US?

Jamming is very different from exploiting a protocol flaw (which is basically what the rouge AP mitigation does).

‘Jamming’ and ‘exploiting a protocol flaw’ are both methods of interfering.

  > 47 U.S. Code § 333 - Willful or malicious interference
  >
  > No person shall willfully or maliciously interfere with
  > or cause interference to any radio communications of any
  > station licensed or authorized by or under this chapter
  > or operated by the United States Government.

If you can ensure that the rouge device is within your network, then you probably know what port on the switch it's connected to, and you can block it from your network without sending any de-auth packets.

I guess if someone is impersonating your SSID then this feature could be useful.

There are different definitions of "rogue AP". Originally, a rogue AP was defined as an unauthorized AP connected to the corporate wired network inside the firewall; these should ideally be blocked by turning off the wired port but that's probably too complex so they resort to spoofed disassociate frames. An unauthorized AP that uses the corporate SSID is also rogue because it could be used for MITMing. Recently some people have started calling "any AP that's not ours" rogue, which is taking it too far IMO and is likely to lead to some FCC smackdown.

It has, in fact, led to some FCC smackdown.

http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-b...

I want to know the answer to this question as well; my university purposefully blocks non-authorized networks.

It is possible/likely that this refers to what Mariott was specifically doing, which is attacking cellular modem/AP combo devices that were not connected to Marott's network in any way, just physically located in/near their hotels.

University Wi-Fi blocking is usually targeted at APs that students have attached to University network drops without permission, which is a completely different thing.

However, the FCC did not appear to draw a distinction, which is interesting.

Agreed. The university unquestionably has the right to prevent you from connecting a device to its wired network. The only question is whether it can use wireless "self-help" to prevent you from doing so.

Right, of course they have the right to prevent me from connecting to their network. But as I understand the FCC advisory, they do not have the right to stop me from using my own personal cellular hotspot, for example.

Does your university actually block all other wireless networks near / on campus? This is prohibited by the FCC.

At my university, the wireless APs would scan for others and try to detect if they were on-network using a student's auth. They'd tell the student to remove the AP if they wanted to continue to have access to the school network. Wireless, off-network hotspots were allowed, provided they weren't impersonating the school network.

if this is an issue, send a letter to the FCC and a copy of this to your IT dep't or something (anonymised from a gmail account maybe?)

If they're not on your network, yes (as they should be). If someone plugs a wireless router into your office ethernet, go ahead.