On Fri, 3 Oct 2014 16:16:22 -0400 "Nick Olsen" <nick@flhsi.com> wrote:
Not sure the specific implementation. But I've heard of Rouge AP detection done in two ways.
Relation discussion on this topic has come up from time to time. I believe the last time was in a thread that starts here and includes various methods of network-based rogue AP detection if you follow all the responses and links: <http://mailman.nanog.org/pipermail/nanog/2012-October/052690.html> One of my favorite ways long ago, not sure if this works reliably anymore, was to watch who was joining well known AP IP multicast groups commonly associated with different wireless gear, something you can easily do on routers (e.g. show ip igmp group _group_address_). There are also a number of well known OUIs associated with AP gear that are easily to monitor for in arp/bridge/cam tables. John