The AirDefense appliance will not learn about MAC addresses which are observed on the local VLAN of the appliance interface. Devices seen as "unknown devices" are really simply devices which the system doesn't know for certain are wireless and can come from one of 4 different sources 1.  SNMP CAM table polls to wired and wireless infrastructure (switches that support bridge or q-bridge MIB) 2.  The sensor wired interface monitors all traffic on the local VLAN.  WiNG 5.0 APs as sensors listen to all traffic allowing for the AP to be placed on a trunk or span port.  WiNG 4.x as sensors only listen to traffic on the VLANs they are configured for 3.  Observed devices over the by the sensors radios.  The sensor will listen to all wireless traffic and create unknown device objects for any device it doesn't observe as transmitting or receiving traffic.  For example the default gateway on the network would show up as an unknown device.  It would be observed wireless as the L2 source or destination for the traffic but because it isn't wireless would never be observed transmitting or receiving traffic. 4.  Manual Import via file.  Due to several customer requests to reduce redundant operation customers can manually import MAC addresses via a file.  This allows customers who are already centrally collecting data from the wired network to eliminate a scan and conserve WAN bandwidth by using data they already have available.