Wireless Monitoring - Rogue AP Detection

We had a situation this weekend where an employee came in to work and decided to bring in his D-Link router from home so he could listen to streaming audio on his iPod Touch. He connected his unsecure router to our network and forgot to take it with him when he went home, leaving part of our network wide open to the world. I have spent this morning researching how to detect such things and I see Orion 10 has built in wireless monitoring. But, while looking for documentation on how to do anything with it (other than add devices that will be detected as wireless devices) I have been coming up with nothing.

So, I am curious, how can I use the wireless monitoring tools of Orion to detect when rogue AP's are connected to our network? Do I need a wireless card in one of our servers? Or a dedicated AP to listen for others?

Any help is appreciated. Thanks in advance.

Find more posts tagged with

Accepted answers

All comments

bshopp

What other "sanctioned" wireless gear do you use within your environment? Cisco or Aruba Controllers?

acherman

Currently we do not have any wireless gear here - while our larger networks consist of licensed microwave links to remote tower sites, our office networks are relatively small. We have discussed Cisco but nothing is implemented yet.

bshopp

So two options

#1 with 10.0 we have scheduled discovery, so as long as we were scanning that subnet, we would have picked up a new IP being used and you could investigate it and determine it was rogue

#2 - Both Cisco and Aruba controllers have rogue detection, here is a doc from Cisco on this here. On the online demo here, if you change the group by to controller you will see an option for rogue AP's. We pull this from the controllers we are monitoring.

mstolle

Am I seeing that Orion supports Cisco and Aruba only?