What parameter is needed to physically locate rogue APs with a protocol analyzer?