METHOD FOR DETECTION OF A ROGUE WIRELESS ACCESS POINT

• US 20120023552A1
• Filed: 07/31/2009
• Published: 01/26/2012
• Est. Priority Date: 07/31/2009
• Status: Abandoned Application

• Current Assignee: Jeremy Brown
• Original Assignee: Jeremy Brown
• Inventors: Brown, Jeremy
• Application Number:
  US13/260,153
• Publication Number:
  US 20120023552A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method for processing a packet is described herein. The packet is received by a network device of a wired network. The packet is filtered if a field in the packet matches a marker designated for indicating a path of the packet includes a rogue access point (AP). Upon filtering, a location on the wired network is determined. The location connects the wired network to a rogue AP from which the packet was received.

Claims

1. A method of processing a packet, the method comprising:

receiving the packet by a network device of a wired network;

filtering the packet if a field in the packet matches a marker designated for indicating a path of the packet includes a rogue access point (AP); and

upon filtering, determining a location on the wired network connecting the wired network to a rogue AP from which the packet was received.

2. The method of claim 1, wherein determining further comprises:

determining an edge port of the network device through which the packet was received.

3. The method of claim 1, further comprising:

determining an address of the rogue AP from which the packet was received.

4. The method of claim 3, further comprising:

blocking the address of the rogue AP at the network device.

5. The method of claim 3, further comprising:

logging at least one of the location and the address of the rogue AP.

6. The method of claim 1, wherein the packet is filtered if an address field in the packet matches a network address marker designated for indicating the path of the packet includes the rogue AP.

7. The method of claim 1, wherein the packet is a user datagram protocol (UDP) packet.

8. The method of claim 7, further comprising:

filtering the packet if the source UDP port field in the packet matches a designated source UDP port marker.

9. An edge network device for use in a wired network, the wired network including a plurality of network nodes, the edge network device comprising:

an edge port configured to receive a packet;

a switch controller coupled to the edge port, wherein the switch controller is configured to filter the packet if a destination address field in the packet matches a network address designated for indicating a path of the packet includes a rogue access point (AP); and

a rogue detection module coupled to the switch controller, wherein the rogue detection module is configured to;

determine the edge port from which the packet was received; and

determine an address of a client device from which the packet was received.

10. The device of claim 9, wherein the rogue detection module is further configured to block the address of the client device at the edge network device.

11. A method comprising:

determining an unsecured wireless network by a controlled node of a wireless network system;

identifying a wireless access point (AP) associated with the unsecured wireless network as a rogue AP;

connecting to the unsecured wireless network through the rogue AP; and

transmitting to the rogue AP a packet including a marker designated for indicating a path of the packet includes the rogue AP.

12. The method of claim 11, wherein the wireless network system includes at least one controlled network device connected to a wired network, and wherein the marker is a valid address in the wired network and is unassigned in the wired network.

13. The method of claim 11, wherein the marker is an IP address placed in a destination field of a header of the packet.

14. The method of claim 11, wherein the marker further includes a source UDP port designated for indicating the path of the packet includes the rogue AP.

15. The method of claim 11, wherein the packet is a user datagram protocol (UDP) packet.