Unit 3: Local networks · Lesson 6 of 7 · 18 min

Finding rogue access points

Compare what the access points can hear with what the company owns and find the impostor broadcasting staff and guest names.

mission

You are
The analyst on wireless duty.
Situation
Each managed access point also scans the air and reports every network it hears. A neighbour's coffee shop is fine. A device broadcasting our own network names is not.
Goal
Find any access point using a corp network name that is not one of ours, and where it is.
Hand in
The rogue BSSIDs, the names they broadcast and the closest managed AP.

A radio impostor

01

Filter to our network names

In the RF scan tab, search for corp-. Every row should belong to one of the three managed BSSIDs.

you should see Two BSSIDs starting c2:7b are not in the Managed APs tab.

02

Read their signal and security

Signal strength (RSSI) closer to zero means closer. -40 is in the same room as the sensor.

you should see Both are heard by ap-floor2 at about -41 and -43, so they are inside the building. The fake corp-guest is open.

defender tip An evil twin of an open guest network is easy to make and catches people who auto-join. Enterprise authentication with server certificate checks stops staff devices joining a fake corp network.

03

Decide the response

Physical search near ap-floor2, check the switch port table for an unknown device, and enable rogue containment alerts on the controller.

you should see A ticket with the BSSIDs, the floor and the time window.

04

Check whether anyone connected

Ask the controller team for the client list near ap-floor2 for the same time window, and reset passwords for anyone who joined the fake network.

you should see A list of affected users, or confirmation that nobody joined.

What a defender takes away

  1. 1Your access points are also your rogue detectors.
  2. 2Compare broadcast names with the list of BSSIDs you own.
  3. 3Strong signal from an unknown BSSID means the device is inside.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.