7

My client recently changed their network policy so now all WIFI routers are disallowed from the network. They said they would be running some scans and that they would be able to find "rogue" WIFI routers on the network.

How would they be able to detect these WIFI routers and access points? They are located remotely to the 100+ branches/corporate offices, so it's definitely a network tool and they're not walking around with WIFI detectors or anything like that.

Just curious, as I thought it was interesting.

Improve this question

7 Answers 7

Reset to default
5

If they're just now implementing that policy then my gut says that their threat of a scan is just scare tactics. But that's just me being cynical...

A few methods would be

  • If the device is a router and not just an access point then they'll be able to see it in the routing paths
  • Network infrastructure device manufacturers have mass blocks of MAC addresses assigned to them to use for their products making it fairly reliable to determine a manufacturer by the MAC address of the device. If, all of a sudden, a few LinkSys or D-Links start popping up and the admins know they don't use those devices....
  • They can look in DHCP. This is especially easy if the network is using reserved DHCP addresses for clients. Anything not in the reserved pool is suspect.
Improve this answer
3
  • 4
    If they're using NAT won't everyone outside the rogue router see everything inside the rogue router as a single valid IP address? You wouldn't even be able to tell it was a router (by IP alone)
    – Tom Ritter
    May 14, 2009 at 21:22
  • How about a spoofed MAC address? Checking it via ESN?
    – setzamora
    May 29, 2009 at 10:43
  • 1
    Linksyses use Mac addresses assigned to Cisco, which it's quite unlikely that they don't use.
    – Fahad Sadah
    Aug 8, 2010 at 18:03
7

Many professional accesspoints like the ones Cisco provide can not only detect rogue accesspoints through the management engines they're connected to - they can actually prevent anyone from using them by attacking them with disassociation packets and whatnot. And of course, report found rogue access points immediately and depending on the number of valid access points in the area - do a somewhat useful location detection as well.

If they're already using a supported wireless solution, which by your mention of the amount of offices, I'd guess they do - it would just be a matter of turning the option on.


The radio monitoring feature uses the radio measurement capabilities on Cisco IOS APs and Cisco Client Adapters to discover any new 802.11 APs that are transmitting beacons. Both clients and APs periodically scan for other 802.11 beacon frames on all channels. Reports of detected beacons are returned to the Radio Manager, which validates these beacons against a list of APs known to be authorized to provide wireless access. A newly discovered AP that cannot be identified as a known authorized AP generates an administrator alert.

source

Improve this answer
2
  • 1
    Interesting. There are no other WIFI access points in the building (professional ones), so that's not what they're using in this case.
    – Sam Schutte
    May 14, 2009 at 14:44
  • That is amazing - what about ppl using for example Internet Sharing on their mobile phone, turning that into a local WLAN? I would take any interception with that use - as a customer or consultant -as interference with my right to use the no license requiring spectrum. There was a court case against that. With MS pretty much requiring that (Surface has no built in SIM capabilities in the Pro versions) that radically interferes with a ton of valid use scenarios. And Let's not talk about things like a Camera / Tablet link (talking of higher end DSL cameras like the Nikon 7200)
    – TomTom
    Jun 22, 2015 at 13:28
2

My guess is that they're checking the MAC addresses associated with wireless access points as described in this guys's blog post.

http://barnson.org/node/611

Improve this answer
2

They could check ARP tables and look at the vendors, or enable 1x on all their switch ports.

Doesn't necessarily stop the access point from being there but it would stop people from using the wireless.

Cisco also has rogue access point detection built into their latest wireless solutions. (I'd assume Aruba does as well).

Improve this answer
1

At your router/firewall look for outgoing packets with a lower TTL than normal. The router part of the WiFi router will lower the TTL value of a packet when if flows through it.

Improve this answer
1

I'd just look for any internal ip address that has more http connections that can easily be explained by a single human. Automated mirroring of a website should be easy to filter out since it'll be lots of traffic to a single domain. That should find any flagrant external access to the company network.

Improve this answer
0

I'd use NMAP in Intense Mode, which will do a good job of identifying devices attached the LAN. In fact, I've recently done this, just to figure out where our existing APs connected in, since it wasn't properly documented.

If I wasn't using NMAP, I'd log in and check the edge switches MAC address tables to identify edge ports with more than 1 MAC address, and then find out what is going on.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.