Where can we find a good list of the MAC address ranges for wireless access points? If I just look by manufacturer (see http://standards.ieee.org/regauth/oui/index.shtml) I do not see a distinction between their access points & their NICs, switches, routers, and other network equipment?
-jcw > To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU > From: Jeff Wolfe <[EMAIL PROTECTED]> > Date: Fri, 4 Feb 2005 15:53:26 -0500 > Subject: Re: [WIRELESS-LAN] Wireless Identification Tools > Reply-To: "802.11 wireless issues listserv" > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> > Return-Path: <[EMAIL PROTECTED]> > Message-ID: <[EMAIL PROTECTED]> > In-Reply-To: <[EMAIL PROTECTED]> > References: <[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Received: from listserv.educause.edu (isaco2.educause.edu [198.59.61.25]) > by bama.ua.edu (8.12.10/8.12.10) with ESMTP id j14L4pbL000857 > for <[EMAIL PROTECTED]>; Fri, 4 Feb 2005 15:04:52 -0600 (CST) > Sender: "802.11 wireless issues listserv" > <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > > Philippe Hanset wrote: > > Don, > > > > A trick that I have been willing to test for a long time would be > > to join the Rogue AP, send traffic to a know sniffing host > > in that same layer2 network. > > This will reveal the Wired MAC address of the AP. > > Then search for that MAC on your wired side and disable the port. > > (if you have a good circuit-to-switchport DB, you know the location as > > well) > > If the AP doesn't allow guests, we use Directional Antennas > > and Wireless Sniffers as you mentioned. > > > > And as I have mentioned before: we rarely have Rogue APs > > in places were we provide decent Free Wireless coverage! > > We've been able to have good luck by searching our switch FDBs for MAC > addresses matching all but the last octet of the MAC address in the > rogue AP's beacon. More often than not, manufacturers use sequential MAC > addresses for the wired and wireless ports of their devices. Of the 5 or > 6 rogues we've seen over the last year, all were locatable that way. > > YMMV.. :) > > > -JEff > > ********** > Participation and subscription information for this EDUCAUSE Constituent > Group discussion list > can be found at http://www.educause.edu/groups/. > ---------------------------------------------------------------- John Watters UA: Office of Information Technology 205-348-3992 ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
