Rogue APs

[Koldov]

Doing a bit of work on the Wireless and noticed a page on the WLC (Cisco 5508) with details of 'Rogue APs' (Unclassified Rogue APs)...

 

Should I be doing something about these?

 

Three are another school nearby (redacted) and I guess a few neighbouring houses going by the VM, TalkTalk and BT SSIDs (I've even seen a local bus Wi-Fi occasionally).

 

There are one or two Hotspots (even one with a phone name just popped up and disappeared), a TP-Link and a few 'unknown' which may be an issue.

 

 

On the WLC I can select them and have 3 options (Remove, Contain, Alert) and they are all currently set to 'Alert'.

 

I presume 'Remove' just removes them (like whack-a-mole) and they'll be back on the next broadcast and 'Alert' just alerts...?

 

Can I block them from the network with 'Contain'?

 

Hopefully they aren't actually 'on' the network as in using our SSIDs, but how can I tell if they are somehow 'on' the network at all?

[dmj]

Can I block them from the network with 'Contain'?

 

That would be a laugh - it would spew 'de-authentication' packets at your neighbours so they couldn't connect to their wifi.

[jthompson]

They would certainly be a concern if they were your using your SSID name(s). Otherwise, they could just be personal mobile hotspots, passing cars/buses, neighbouring properties, etc.

 

In terms of telling whether they're patched into your physical network, you probably going to need to use some other tools/features in your environment.

 

We use UniFi here, and the rogue AP list indicates which of our APs are seeing them, which can help to triangulate things a bit.

[Koldov]

Well, that's me busy for the next couple of hours!

 

Yes, I can see now drilling down gives me this...

 

"APs that detected this Rogue - AP Name: AP6485.d019.5a68 / SSID - AndroidAP C16B"

 

That AP is in a classroom, but they've got quite a range, so doubtful I can narrow it down too much (in the middle of school though so probably not a passing car/bus/member of the public... unless it was a parent... or a child before they had to hand their phones in this morning )...

 

Hmmm, thinking about it now, I can see this is going to get me nowhere fast....

Edited February 9, 2023 by Koldov

[MatthewL]

I live on a bus route and a cut through and in the last 24 hours accoording to my Unifi I've had 114 neighbouring access points come into contact with my home network! 20 of which in the last hour and just shy of 1439 in last 120 days!!! Yet my brother a mile away is 314, 39 and 6000!!

 

Think yourself lucky.