Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my LAN there are some Mac users who share their LAN connection by creating a hotspot via their Airport. I can see the newly created WiFi networks on any WiFi capable device. How can I find out who creates the hotspot and shares the internet to outside world?

share|improve this question
I hope that you have a clearly-communicated policy so that the users understand that they're not supposed to be doing this. – mfinni Apr 6 '13 at 13:10

If you have some kind of flow data logged in your network (e.g. netflow or sflow), you should easily be able to detect a suspicious amount of connections originating from specific IPs NATting to the network behind it. Also, techniques detecting the use of NAT based on IP TTL decrements exist. Mapping this IP address to a device or a user has to be possible, though.

Other than that, your existing access point infrastructure might help you with detecting surrounding WLANs and alert you upon appearance of new APs ("rogue AP detection"). If you have APs running with a central WLAN controller you most likely would have this functionality. Enterprise-level stand-alone APs also would be able to provide the same kind of information over SNMP. Just identifying a WLAN is not identifying its owner of course, but at least you would be notified that you should take a decent look at what is happening.

share|improve this answer
+1. Though if the AP is open, it might be easier to just connect a client to it and run a traceroute to see what IP is acting as the gateway, then trace the IP to the user. – David Houde Apr 6 '13 at 9:02

A cellphone with one of those 'wifi scanner' apps does the trick.

I had an infestation of this a while ago, including a [colorful description of person's intelligence redacted] who plugged in a home router with dhcp function, so we had a rogue dhcp server. After logging in on the device (yay default passwords), disabling the dhcp server and changing the password, I simply took a phone with a wifi scanner app that reports the strength of the channel. That can be used to home in on the transmitter quite nicely. The device is now sitting in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.