Patent ID: 7339914

Claim:
A method for monitoring for unauthorized wireless access to computer networks, the method comprising: receiving a list of one or more wireless access point devices which are allowed to be connected to a computer network within a selected geographic region; monitoring wireless communications within the selected geographic region using one or more sniffer devices to at least detect an active wireless access point device that transmits wireless signals within the selected geographic region, the one or more sniffer devices being spatially disposed within the selected geographic region; determining that the active wireless access point device is not among the one or more wireless access point devices which are allowed to be connected to the computer network within the selected geographic region; transferring a plurality of marker packets into the computer network, the plurality of marker packets being adapted to be transferred to wireless medium within the selected geographic region from the computer network through one or more wireless access point devices which are actually connected to the computer network and which are configured to function as layer two bridges between their wired and wireless interfaces, the plurality of marker packets having a predetermined format, at least a subset of the one or more sniffer devices being configured to be able to identify at least a portion of the predetermined format, the transferring being actively transferring at least for a process of detection of unauthorized wireless access to the computer network; processing using at least one of the at least the subset of the one or more sniffer devices at least a portion of the monitored wireless communications within the selected geographic region, the processing being directed to at least identifying at least one of the plurality of marker packets being actually transferred from the computer network to the wireless medium within the selected geographic region through the active wireless access point device, the processing including identifying the at least the portion of the predetermined format within at least one of one or more packets included in the at least the portion of the monitored wireless communications; and determining that the active wireless access point device provides unauthorized wireless access to the computer network based at least upon the at least one of the plurality of marker packets being identified as transferred from the computer network to the wireless medium within the selected geographic region through the active wireless access point device and the determining that the active wireless access point device is not among the one or more wireless access point devices which are allowed to be connected to the computer network.