Detecting anauthorised APs during wireless assessment

[ag3nt]

Hello everybody!

I've got a question about detecting unauthorized APs in facilities during wireless assessment, as this might be one of the objectives in penetration test.
Has anyone did such work, what tools and hardware do you usually use with backtrack5 and how does it looks in practice?

As for me I've practiced in BT with kismet and airodump-ng on my net-book and looked for signal level and quality of signal which are PWR and RXQ, but I don't think that this is the most accurate decision, as in my report I would like to mark the floor and nearby room where unauthorized AP was spotted.

[ShadowMaster]

I use the ALFA AWUSO36H. It's got a great 5 dbi antenna, and I got another 9 dbi extender. If that doesn't improve your reception nothing will. Incidentally, theres a great program out there in forumland called fern-wifi-cracker, that'll do it for you.

[valasudurai]

thank you i am a beginner in back track

[Barry]

For tracking down rogue access points, you want the lowest dbi antenna you can get. The higher dbi, usually means the longer range you'll "see" an access point. You can start out with a bigger antenna, but to get it down to which room, you'll need a smaller antenna, or attenuate the signal some how.

[TAPE]

I seem to remember that Barry (?) also advised that Heatmapper could be used
for such a task to find unauthorized (wireless) APs around ;

http://www.ekahau.com/products/heatm...een-shots.html

It works pretty well actually, but this is a windows application and not on BT.

[Barry]

Yea, that was probably me. The more data points you can give it the more accurate it is. I've also just found a program for Android that does the same thing, but I'm not paying $50 for a phone app...

[brill]

Hello,
Just curious if there are any enterprise wide methods of detection, preferably linux. We have over 200 locations and the threat of rogue AP's is constant. For sites that have AP's (not all do or can afford to) I can spot rogue AP's that way. Visiting each location with an alfa and appropriate software is not a viable option. 802.1x is certainly on the horizon and I suppose I could collect all 50,000 enterprise MACs and then compare those against trusted OUI's. Any thoughts on a better strategy welcome.

brill