Patent ID: 7603710

Claim:
In a wireless network, a method comprising: detecting a first packet identifying a wireless access device, a type of the first packet, and at least one device currently communicating with the wireless access device; defining a first state of operation of said wireless access device as the type of the first packet and the identity of the at least one device; creating a state transition table for the wireless access device that includes a first entry indicative of the first state; observing a sampling of fewer than all of a plurality of packets transmitted or received by the wireless access device to determine a type of the sampled packets and one or more source devices or one or more destination devices of the sampled packets; defining a current state of operation of the wireless access device as the type of the sampled packets and the one or more source devices or destination devices; determining, based on said sampling of packets, that a state change has occurred for the wireless access device when the first state differs from the current state, and when said state change has occurred: identifying said state change in said state transition table, generating an event notification indicating said state change, and checking, using at least one security policy element, whether the state change corresponds to a prohibited activity based on said event notification; and sending, based on a result of said checking, an alert indicating that said state change has occurred in the wireless network only when the result of said checking indicates a violation of the at least one security policy element.