In the context of Juniper Mist WxLAN Security and Rogue AP detection, Mist AI categorizes surrounding access points into specific buckets based on their behavior and their connection to the local network infrastructure. Understanding the distinction between a Rogue AP and a Honeypot AP is essential for proper security posture.

A Honeypot AP (C) is specifically defined as an unauthorized access point that is broadcasting one of your organization's protected SSIDs (or a very similar one) but is not physically connected to your wired network. This is a classic "Evil Twin" attack where a malicious actor attempts to trick corporate users into connecting to a fake signal. Because the clients’ devices are often programmed to auto-associate with known SSIDs, they may unknowingly connect to the Honeypot AP, allowing the attacker to intercept traffic, perform man-in-the-middle attacks, or harvest credentials. Mist APs use their dedicated scanning radio (found in the AP43, AP45, and similar models) to constantly monitor the airwaves for these spoofed SSIDs.

In contrast, a Rogue AP (D) is an unauthorized AP that is physically connected to your corporate wired network (LAN). Mist identifies these by correlating the MAC addresses seen on the air with those seen on the wired switch ports. A Neighbor AP (B) is simply an AP from a nearby business that is broadcasting its own unique SSID and is not connected to your network; these are ignored by security alerts.

By classifying the threat as a Honeypot, Mist AI informs the administrator that the threat is external to the wired infrastructure but poses a direct risk to client data. Mist can even be configured to take automated action, such as sending de-authentication frames to prevent clients from successfully staying connected to the malicious Honeypot AP.