Detecting Rogue Wireless Routers

[ryanbetemps at gmail.com (Ryan Betemps)]

Hello,
Thanks to Paul's great Tech Segment on Discovering Rogue Access Points
With Nmap I have start to experiment more with Nmap.

Does anyone have any ideas how you could use Nmap to scan a large
enterprise network for rogue wireless routers with the WAN port
connected to the enterprise network? Typically the WAN port on SOHO
routers are running a lot less (if any) services on the WAN port.

Thanks