Evil Twin detection in Solarwinds?

Is Solarwinds able to detect Evil Twin attacks? NPM obviously has all sorts of WiFi tools but my searching has not turned up any results on Evil Twin or even Rogue AP detection. We are looking at the possibility of upgrading to HCO and this has come up in our discussions.

* Edit: I did find the below but it is 13 years old...was hoping for more current information. The assumption would be that Solarwinds polls the controller for this info as it did back then?

thwack.solarwinds.com/.../wireless-monitoring---rogue-ap-detection

Find more posts tagged with

wifi

Evil Twin

wireless access points

WLAN Security

rogue ap

Accepted answers

adam.beedell

Saw reference to Rouge APs being detected by essentially asking the controllers what their view is. I believe that's what goes into the "rouge APs" widget OOTB

HCO is like, patch to 2023.3, switch to regular licensing, and up the products to like 8. So if you've got the networkey products already it probably isnt changing the situation for you much

Otherwise you can imagine some sort of feed in about IPs and/or filled ports from NPM scans/IPAM/etc and then trigger an alert if not confirmed good by whatever means confirms something's not an evil twin.

All comments

adam.beedell

I'm not familiar with this sort of security thing, not my space, familiar enough with the tool though. I've seen a rogue APs section in solarwinds before. I think there's a report off of NCM or something. Could you elaborate on what you're hoping for it to do>

MACGoof

Thanks for taking the time to answer. Really appreciated.

My team are trying to determine the capabilities of HCO if we were to upgrade our Solarwinds deployment rather than renew what we currently have.

In a nutshell, we received the results of a recent third party pen-test and one of the recommendations was to attempt to mitigate Evil Twin attacks at one of our facilities. Evil Twin attacks are similar to Rogue APs in that they present an illegitimate WiFi connection to clients. There are differences that might be a bit long winded for this post. I suspect that Solarwinds relies on the wireless controller to detect Rogue APs and in turn, Evil Twin attacks as well if capable.

Would you have any handy literature on how Solarwinds detects Rogue APs? I might be able to spin off of that to see if Evil Twin detection is even possible or if we would need to look at a specialized tool.

Thanks again and I look forward to your reply.

*edit: Or would it be more fruitful to contact support directly?

adam.beedell

MACGoof

Thanks again. That confirms what I suspected and provides some perspective on HCO. I appreciate your time.