Security Basics mailing list archives
Re: Wireless blocking
From: "Alex S. Harasic" <alharasic () mi cl>
Date: Wed, 05 Oct 2005 12:49:53 -0400
Like Mark said, I think the best way is to identify the Wireless AP through wire.
I guess the risk is that the Wireless AP is connected to the network, therefore it's connected in a switch somewhere. You can always see what port it's connected to quering the switch of a certain mac address. Wireless AP have a generic MAC address so you can easily find it with something like:
show ip arp | include 0040.96in your router, I now that 0040.96 works for cisco aironet AP.
You can also check Kirby Kuehl presentation on this matter called "Detecting Rogue 802.11 Access Points within the Enterprise".
Regards Alex S. Harasic On Tue, 4 Oct 2005 19:57:24 -0400 Mark Owen <mr.markowen () gmail com> wrote:
On 10/4/05, Daryl Davis <daryl () ultbingo com> wrote:I believe I have an unauthorized wireless router on my network. I have beenunable to physically find it as of yet.Does anyone know how to find the hidden SSID and then Jam it?Did it receive an ip address via dhcp?That might help you out in tracking at least which port it is pluggedinto (via mac address.) Best bet is to trace down cable and pull the plug. Block mac address from dhcp.Kick it off network by assigning another throw away device same IP aswireless (at least confuse it)All else, take $LUSER for a ride in a nice Cadillac down a bumpy roadin the trunk. -- Mark Owen
Current thread:
- Wireless blocking Daryl Davis (Oct 04)
- Re: Wireless blocking Mark Owen (Oct 05)
- Re: Wireless blocking Alex S. Harasic (Oct 06)
- RE: Wireless blocking David Gillett (Oct 05)
- Re: Wireless blocking Huiling (Oct 05)
- Re: Wireless blocking xyberpix (Oct 05)
- <Possible follow-ups>
- RE: Wireless blocking Hayes, Ian (Oct 05)
- Re: Wireless blocking Tom Van de Wiele (Oct 05)
- Re: Wireless blocking xyberpix (Oct 06)
- Re: Wireless blocking Kevin white (Oct 06)
- RE: Wireless blocking Patton Roub (Oct 05)
- RE: Wireless blocking Charles Hammett (Oct 05)
- RE: Wireless blocking Bryan McAninch (Oct 05)
(Thread continues...)
- Re: Wireless blocking Mark Owen (Oct 05)