Re: Marriott wifi blocking

[John Kristoff <jtk () cymru com>]

On Fri, 3 Oct 2014 16:16:22 -0400
"Nick Olsen" <nick () flhsi com> wrote:

> Not sure the specific implementation. But I've heard of Rouge AP
> detection done in two ways.

Relation discussion on this topic has come up from time to time.  I
believe the last time was in a thread that starts here and includes
various methods of network-based rogue AP detection if you follow all
the responses and links:

  <http://mailman.nanog.org/pipermail/nanog/2012-October/052690.html>

One of my favorite ways long ago, not sure if this works reliably
anymore, was to watch who was joining well known AP IP multicast groups
commonly associated with different wireless gear, something you can
easily do on routers (e.g. show ip igmp group _group_address_).

There are also a number of well known OUIs associated with AP gear that
are easily to monitor for in arp/bridge/cam tables.

John