[TriLUG] Detecting rogue wifi access points

[Brian Daniels]

On Thu, Aug 21, 2008 at 02:39:29PM -0400, Matt Frye wrote:
> I'm looking to find out what's needed to detect rogue wifi access
> points in an office.  Anyone have experience doing this?
> 

Kismet/mac?  It can find points that aren't broadcasting SSID (assuming that 
someone is using them).  

Do a wired TCP scan for devices with port 80 open?  Most access points have a 
built-in webserver.  This is going to find printers and other devices too.  
Maybe even the coffeepot...

--Brian


-- 
Be it thy course to busy giddy minds
With foreign quarrels; that action, hence borne out,
May waste the memory of the former days.
			Henry IV, Part 2
	

Brian Daniels                  bitmage at pobox.com
      http://www.eviloverlord.net