[TriLUG] Sanctioned warchalking - Linux wireless sniffer recommendations?

[John Beimler]

Mike Shaw wrote:

>I would also be interested in any opinions on how
>effective this has been at your site.  My management
>is mainly wanting to make sure the average Joe
>Engineer doesn't drop an access point on the network. 
>We are looking at other detection methods
>also(checking at the router, possible RF scanning),
>this is just going to be one tier in a layered
>approach to minimize a possible wireless network
>breach.
>
>  
>
At our company there are scans for MAC addresses that map to the low end 
WAP vendors. They find one, and they turn off the port. I learned this 
putting a Linksys router on the network for some firewall testing.

Peace.

john