a location-aware rogue ap detection system based on wireless packet sniffing of sensor aps
For easy installation and increasing the use of wireless LAN access points (AP), an unauthorized AP can be quickly plugged into the LANs of most organizations. Unauthorized APs are also termed rogue APs, and can seriously threaten network security. Detecting the existence of rogue APs has become an important research topic. A rogue AP should work by broadcasting wireless packets. This paper proposes a rogue AP detection system based on sensing the existence of AP packets. Once the MAC address of the AP packets is not on a white list, the system will find the location of the suspected AP. If the location of the suspected AP is outside the managed area, this AP will be classified into be a neighbor AP. Conversely, the suspected AP will be deemed a rogue AP. The proposed system adopts the AP with an open source firmware, OpenWrt, and an open source MAC layer sniffing application, kismet, to monitor wireless packets. The research demonstrated efficient detection of rogue APs and can further strengthen the security of wireless networks.
rogue ap detection wireless packet sniffing network security packet analysis