Detection and management of rogue wireless network connections
US8000698B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 25, 2006 |
| Grant date | Aug 16, 2011 |
| Priority date | — |
| Expiry date | Jun 9, 2027 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04W88/08
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method of detecting rogue devices that are coupled to a wired network without generating false negative or false positive alerts is provided. When a wireless monitor detects an observed SSID and/or BSSID, various tests are run to determine whether the observed device is actually coupled to the wired network. To guard against the suspect device spoofing an authorized SSID and/or BSSID, location information is gathered so that the network administrator can pinpoint the location of the rogue device. If the device is not recognized, various other tests are run to determine whether the unrecognized device is actually connected to the wired network. These tests include an association test, a MAC address test, an ARP test, a packet replay test, a correlation test, and/or a DHCP fingerprint test. Once it is determined that the suspect device is a rogue connected to the wired network, an appropriate alert is generated.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.