idea for detection of rouge nodes?

["Fred McFeeters" <nfolink () hotmail com>]

Hello all.

    This may be a dumb idea; however I wanted your thoughts.

 

I have a very small network 6 node, with a wireless AP. All my wireless
clients are windows XP machines, so I was thinking that if I setup some type
of rule that looks for (">>> NBT UDP PACKET(137): REGISTRATION; REQUEST;
BROADCAST") and within that packet the ("Name=Name Of Computer NameType=0x00
(Workstation)") then if sees a packet that doesn't have the name of one of
my computers it sets off an alert?

 

Now I know this could be very simply bypassed but how many people when WIFI
hunting think to change there computer name also? Most would only change the
IP and MAC to match that of the computer they want to clone.

 

Thanks for your thoughts

 

Fred McFeeters