Detecting Rogue Access Points / APs in Your Wired and Wireless Network

Detecting Rogue APs | Rogue AP | Wireless Security

What is a Rogue AP?
A rogue AP is any unauthorized or undocumented WiFi Access Point that shows up in your wireless LAN (WLAN) or wired LAN.

Are all Rogue APs Malicious?
Not all rogue APs are work of a malicious intruder -some of them may be devices that you (or your network administrator) has not yet fully documented/listed on your network topology; while others could be work of one of your over-enthusiastic colleague trying to install her own access point for her convenience or bragging rights. Some times a rogue AP showing up on your radar may be an AP powering a newly configured WLAN owned by someone within close proximity of your location. It is also possible; of course, that the rogue Access point may indeed be work of someone trying to gain unauthorized access to your WLAN or to your users' data.

Assume All Rogue APs to be Malicious Until Proven Benign:
It is prudent to assume all rogue APs to be malicious unless they are proven (conclusively) to be otherwise -specially in cases involving public WLANs (such as a WLAN at your favorite hotel/motel, corner cafe, airport, or a citywide wifi hotspot) that are designed to serve a mobile or transient (i.e. often unknown) user-base.

You are on a look out for Rogue APs, Aren't you?
We are, of course, going to assume that you have a way to detect rogue APs within your wired or wireless LANs, and that you are actively/routinely on a look out for rogue/parasitic devices within or near the endpoints/boundaries of your wireless network. If not, read on...