Rogue AP Detection Methods

What Makes Rogue APs Dangerous

A rogue access point is any wireless AP on your network that you did not authorize. The threat is severe because an AP acts as a bridge between the wireless medium and your wired network. Anyone who connects to a rogue AP gets direct access to whatever network the AP is plugged into.

If someone plugs a cheap wireless router into an Ethernet port in your office or home, every device that connects to that rogue AP's WiFi has full access to your LAN. Firewall rules, VLANs, network segmentation - all bypassed because the rogue AP sits behind all of those controls, directly on the trusted network.

Rogue APs are not always malicious. Employees bringing personal routers to work, visitors plugging in travel routers, or IoT devices with hidden AP functionality (some printers and cameras create ad-hoc networks) all create unintentional rogue APs. The security impact is the same regardless of intent - an unauthorized entry point into your network.

Types of Rogue Access Points

Rogue APs fall into several categories based on how they connect and what they do.

Wired rogue AP. A physical device plugged into your network's Ethernet infrastructure. This is the classic rogue AP - someone connects a consumer router to a network jack, creating an unauthorized wireless entry point into your LAN. Detection requires both wireless scanning (to find the AP) and wired-side investigation (to find which switch port it is connected to).

Software AP. A laptop or phone running hostapd or similar software, creating an AP from its WiFi interface while connected to your network via Ethernet or another WiFi connection. Harder to detect physically because it looks like a normal laptop, not a router.

Evil twin. An AP configured to impersonate your legitimate network by using the same SSID (and potentially the same MAC address). Devices may connect to the evil twin instead of your real AP, especially if the evil twin has a stronger signal. All traffic through the evil twin is visible to the attacker. This is an active attack, not an accidental misconfiguration.

IoT hidden AP. Some devices create wireless access points as part of their normal functionality - printers with WiFi Direct, IP cameras with setup modes, smart home hubs with their own networks. These are often overlooked but create real entry points.

graph TD
    subgraph "Rogue AP Types"
        subgraph "Wired Rogue"
            WR_DEV[Consumer Router] -->|Ethernet Cable| WR_JACK[Network Jack]
            WR_JACK --> WR_LAN[Your LAN]
            WR_DEV -->|Unauthorized WiFi| WR_CLIENT[Attacker Devices]
        end
        subgraph "Evil Twin"
            ET_DEV[Attacker AP] -->|Same SSID as Your Network| ET_VICTIM[Your Devices Connect]
            ET_VICTIM -->|All Traffic Visible| ET_ATK[Attacker Sees Everything]
        end
        subgraph "Software AP"
            SAP_LAPTOP[Laptop with hostapd] -->|WiFi AP| SAP_CLIENT[Connecting Devices]
            SAP_LAPTOP -->|Ethernet to Your LAN| SAP_LAN[Your LAN]
        end
        subgraph "IoT Hidden AP"
            IOT_DEV[Printer/Camera] -->|WiFi Direct/Setup Mode| IOT_AP[Hidden AP Active]
        end
    end

Four types of rogue access points - each creates an unauthorized wireless entry to your network

Wireless Monitoring Detection

The most direct way to detect rogue APs is to scan the wireless environment and look for APs that should not be there. This is 802.11 monitoring - putting a WiFi adapter into monitor mode and passively listening for beacon frames from all nearby access points.

Every AP broadcasts beacon frames roughly ten times per second, announcing its SSID, BSSID (MAC address), channel, security settings, and supported data rates. A monitoring device collects these beacons and builds a picture of every AP in range.

Detection happens by comparing what you see against what you expect. If your network has three legitimate APs with known BSSIDs, and a scan reveals a fourth AP on your network's SSID, that fourth AP is either a rogue or an evil twin. If a scan reveals an AP with an SSID like "Free WiFi" broadcasting from within your building, someone has brought unauthorized hardware.

BSSID Matching Against a Known-Good List

The foundation of rogue AP detection is a known-good list of authorized access points. For each legitimate AP on your network, record the BSSID (MAC address), SSID, channel, and physical location.

During a scan, any AP broadcasting your network's SSID with a BSSID not on the known-good list is a rogue. Any AP with an unknown SSID broadcasting from within your premises is suspicious. Any AP with a BSSID close to (but not matching) one of your legitimate APs could be a spoofing attempt.

Building the known-good list is a one-time effort. Log into your wireless controller or check each AP's management interface to get its BSSID. Record these in a document you can reference during scans. Update the list whenever you add, remove, or replace APs.

Signal Strength Analysis

Signal strength (RSSI) provides location clues. If you are scanning from inside your building and detect an unknown AP with a very strong signal (-30 to -50 dBm), that AP is physically close - likely inside your building or immediately outside. An unknown AP at -80 dBm is probably a neighbor's network and less concerning.

For evil twin detection, signal strength comparison is valuable. Your legitimate AP at a known location should have a consistent signal strength from a given scanning position. If you suddenly see two APs with the same SSID, one at the expected signal strength and another significantly stronger or weaker, the anomalous one warrants investigation.

Walking a scan through your premises (a WiFi site survey approach) maps signal strength to physical location. This helps you approximate where a rogue AP is located, which is essential for physically finding and removing it.

Wired-Side Detection

Wireless scanning finds rogue APs from the air side. Wired-side detection finds them from the network side. The two approaches complement each other.

On a managed switch, you can view the MAC address table for each port. A switch port that shows multiple MAC addresses - especially wireless device MAC addresses - might have a rogue AP connected. Normal devices show one MAC per port. An AP shows its own MAC plus the MACs of every device connected to it.

802.1X port authentication (if your infrastructure supports it) prevents unauthorized devices from accessing the network at all. A rogue AP plugged into a switch port that requires 802.1X authentication will fail to authenticate and be placed in an isolated VLAN or blocked entirely. This is preventive rather than detective - it stops rogues rather than just finding them.

Network Access Control (NAC) solutions combine MAC authentication, 802.1X, and device profiling to identify and quarantine unauthorized devices. This is enterprise-grade and overkill for most home networks, but understanding the concept helps frame what is possible.

Detection Tools

Several tools handle rogue AP detection at different scales.

BLEShark Nano. The Nano's WiFi scanner provides a quick, portable scan of all nearby access points. Walk through your premises with the Nano and note every AP it detects. Compare against your known-good list. The Nano's portability makes it practical for periodic sweeps - check different areas of your home or office without setting up permanent monitoring infrastructure. Its small size means you can quickly scan areas where a permanently mounted sensor might not reach.

Kismet. A full-featured wireless IDS that runs on Linux with a compatible WiFi adapter in monitor mode. Kismet monitors continuously, building a database of all observed wireless devices over time. It can alert on new APs, track device movement, and detect various wireless attacks. For permanent monitoring, Kismet is the standard.

Enterprise WIDS. Cisco, Aruba, and other enterprise wireless vendors build rogue AP detection into their wireless infrastructure. Dedicated sensor APs continuously scan all channels and report unauthorized APs to a central controller. This is the most comprehensive solution but requires enterprise wireless infrastructure.

graph LR
    subgraph "Detection Approach"
        subgraph "Periodic Scanning"
            NANO[BLEShark Nano] -->|Walk-around Survey| SCAN_RESULT[AP List with RSSI]
        end
        subgraph "Continuous Monitoring"
            KISMET[Kismet on Linux] -->|24/7 Monitoring| ALERT_DB[Alert Database]
        end
        subgraph "Enterprise WIDS"
            SENSOR_AP[Dedicated Sensor APs] -->|Continuous Scan| CONTROLLER[Wireless Controller]
        end
    end
    subgraph "Analysis"
        SCAN_RESULT --> COMPARE[Compare Against Known-Good List]
        ALERT_DB --> COMPARE
        CONTROLLER --> COMPARE
        COMPARE -->|Match| LEGITIMATE[Known AP - Ignore]
        COMPARE -->|No Match| INVESTIGATE[Unknown AP - Investigate]
    end
    subgraph "Response"
        INVESTIGATE --> LOCATE[Locate Physically]
        LOCATE --> REMOVE[Remove or Authorize]
    end

Rogue AP detection workflow - scan, compare against known-good list, investigate unknowns, and respond

The Evil Twin Problem

Evil twins deserve special attention because they are harder to detect than simple rogue APs. An evil twin uses the same SSID as your legitimate network - and a sophisticated attacker will also clone the MAC address (BSSID) of one of your real APs.

Devices choose which AP to connect to based primarily on signal strength. An evil twin with a stronger signal than your legitimate AP will attract your devices automatically. Once connected, all traffic passes through the attacker's hardware, enabling full man-in-the-middle attacks.

Detection clues include seeing the same BSSID on a channel different from where your legitimate AP operates, seeing duplicate BSSIDs with different signal strengths from the same scanning position, and observing clients rapidly disassociating from your legitimate AP and reassociating (which happens when a deauth attack pushes clients toward the evil twin).

Prevention relies on 802.11w Protected Management Frames (which prevents the deauth attack used to push clients to the evil twin) and enterprise WPA (802.1X) which authenticates the network to the client, not just the client to the network. With 802.1X, a client verifies the RADIUS server's certificate before associating - an evil twin without the correct certificate is rejected.

Building a Detection Routine

For home and small business networks, a monthly rogue AP scan is a reasonable baseline. More frequent scans are warranted in higher-risk environments or after events like office moves, new employee onboarding, or contractor visits.

A practical routine: document all legitimate APs (BSSID, SSID, channel, location). Once a month, walk through your premises with the BLEShark Nano and scan each area. Compare the detected APs against your documented list. Investigate any AP that appears on your SSID with an unknown BSSID, any AP with a suspicious SSID broadcasting from within your premises, and any AP with unusually strong signal that was not present in previous scans.

For the investigation, try to locate the AP physically using signal strength as a guide (walk toward stronger signal). Check if the AP is connected to your network (check switch MAC tables). If it is unauthorized, disconnect it. If it is an evil twin (same SSID, not connected to your network), it is an active attack and warrants a more serious response.