Slashdot Mirror

← Back to Stories (view on slashdot.org)

Rogue Access Point Detection?

Posted by Cliff on from the plugging-the-holes dept.

Yossarian2000 asks: "With all the media attention WLANs have been getting lately, more and more businesses seem to be looking to better understand their implications as relates to company intranets. Whether a business is running a WLAN or not, detecting rogue access points is essential to maintaining some degree of security. Currently, it seems there are few options for detecting APs: subnet scans (which add overhead to the network and can still miss some APs), handheld devices (which require regular site surveys), and systems that use existing access points to detect rogues (this assumes you have APs covering your entire site). Has anyone heard of better methods for the detection of rogue APs?"

3 of 53 comments (clear)

  1. ObJurrasicParkQuote: I know this, this is Unix! by Nathan+Ramella · · Score: 4, Interesting
    this should do the trick. It goes from 10Mhz up to 2.6ghz, which should cover 802.11b (2.412Ghz (ch 1) to 2.462Ghz (ch 11))

    Shows signal strength too so you can do the James Bond homing-in-on-the-signal-with-gun-drawn type stuff.

    -n

    --
    http://www.remix.net/
  2. Re:Welll.... by shaitand · · Score: 3, Interesting

    mac based security is not the answer, it's so easy to clone a mac it's not even funny anymore. A mac is no more secure than an IP, anyone can set it.

  3. MAC filtering revisited. by billn · · Score: 3, Interesting

    It's mentioned in another thread that it's fairly easy to change a MAC address, but on most OTS AP's, that's not the case. Provided you have intelligent switches or at least machines with decent scripting kits, you can watch your ARP tables for common vendor MACs, like Linksys or Dlink. The downside to this, is that your ARP cache might not spot an AP in bridging mode, but a decent managed switch would, since it has to forward frames.

    --
    - billn