What are the tools and techniques for identifying and locating rogue or unauthorized WLAN devices?

1 WLAN scanner

A WLAN scanner is a software or hardware tool that can scan the wireless spectrum and detect the presence and characteristics of WLAN devices. It can show you the device name, MAC address, SSID, channel, signal strength, encryption type, and other information. You can use a WLAN scanner to identify rogue or unauthorized devices by comparing their MAC addresses or SSIDs with your authorized devices, or by looking for suspicious or unknown devices. Some examples of WLAN scanners are NetSpot, inSSIDer, Wireshark, or Kismet.

2 Spectrum analyzer

A spectrum analyzer is a device that can measure and display the frequency and amplitude of the signals in the wireless spectrum. It can help you identify the sources of interference or noise that affect your WLAN network. A spectrum analyzer can show you the signal shape, bandwidth, modulation, and power of the signals. You can use a spectrum analyzer to locate rogue or unauthorized devices by looking for signals that match the frequency and characteristics of WLAN devices, or by looking for signals that are stronger or weaker than expected. Some examples of spectrum analyzers are MetaGeek Wi-Spy, Ekahau Sidekick, or Anritsu Spectrum Master.

3 Directional antenna

A directional antenna is an antenna that can focus or receive signals in a specific direction. It can help you locate the physical position of a WLAN device by pointing the antenna towards the device and measuring the signal strength. You can use a directional antenna to find rogue or unauthorized devices by following the signal from the WLAN scanner or spectrum analyzer until you reach the device. Some examples of directional antennas are Yagi, Panel, or Parabolic antennas.

4 Ping and traceroute

Ping and traceroute are network tools that can test the connectivity and latency of a WLAN device. They can help you identify the IP address and the route of a WLAN device by sending packets and measuring the response time. You can use ping and traceroute to verify rogue or unauthorized devices by comparing their IP addresses or routes with your authorized devices, or by looking for devices that do not respond or have high latency. Some examples of ping and traceroute tools are Windows Command Prompt, MacOS Terminal, or PingTools.

5 Network access control

Network access control (NAC) is a security technique that can prevent or limit the access of unauthorized WLAN devices to your network resources. It can help you eliminate rogue or unauthorized devices by enforcing policies and rules based on the device identity, role, location, or behavior. You can use NAC to block rogue or unauthorized devices by using authentication methods, encryption protocols, firewall rules, or VLAN segmentation. Some examples of NAC solutions are Cisco ISE, Aruba ClearPass, or ForeScout CounterACT.

6 WLAN audit

A WLAN audit is a systematic process that can evaluate the performance, security, and compliance of your WLAN network. It can help you detect and resolve any issues or vulnerabilities caused by rogue or unauthorized devices. You can use a WLAN audit to improve your WLAN network by using tools and techniques such as site survey, penetration testing, configuration review, or policy update. Some examples of WLAN audit services are AirMagnet, Fluke Networks, or Ruckus Wireless.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?