Re: [WIRELESS-LAN] locate the rogue AP from wired side

[Frank Bulk - iNAME.com]

If you want to do some distributed wireless security monitoring, you might want to look at a solution from AirDefense or AirMagnet.  Network Chemistry has a cheap monitoring solution.   As for wire side detection, it's rather difficulty because the Ethernet MAC may or may not be the same as the wireless MAC.  Many times they are within plus/minus 1, but not necessarily.  They could be from two different sets.   Probably the easiest way to identify which room is to do some rough triangulation, or, use a laptop, associate to the AP, ping from inside your network to your laptop, and then trace the route to your laptop's MAC.   Frank >>> [EMAIL PROTECTED] Tuesday, February 17, 2004 2:23:06 PM >>> Our campus, as all other universities in US, has lots of rogue APs. People spent less than 100 dollars each bought them from Bestbuy or circuitcity and plug them into the campus wired network. A large portion of the Rogue AP population even don't have WEP on. Everybody agrees that it could cause security problems. But some people don't care. We have repeatedly told them not to do so and they still keep doing so. If we are going to shut them off , how do we physically locate them? With netstumbler or similar tools, it is not difficult to find them, wirelessly. The BSSIDs or MAC addresses of the radio card are easy to get. But is it possible to find those APs from wired side? or more specifially, locate the port to which this rogue AP connect, provided it is hooked into campus network? What we have: access to the MAC cache of all campus switches, the BSSID/MAC address of the radio card. Anybody has been facing the same problem/needs? Any efficient tools/software available? Thanks a lot! -- ------------------------------------- Sean Che Network Engineer Network Services Wayne State University Voice: (313)577-1922 Pager: (313)990-5403 Email: [EMAIL PROTECTED] ------------------------------------- ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/cg/ . ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/cg/.