Passive online rogue access point detection using sequential hypothesis testing with TCP ACK-pairs
Detecting protected layer-3 rogue APs