0

Let's say we have a network with multiple access points. The command arp -a can be used to list the IP addresses and physical addresses of the devices that are on the same network. Now, is there a way to identify which of these devices is an access point using the IP address (or otherwise)?

Edit: to give more context, what I wanna do is to check for Rogue Access Points by identifying the access points on the network and then compare them to a list of legitimately installed access points.

2
  • 1
    There's no "universal" way. however, if you know the manufacturer, there may be options – Ron Trunk May 27 at 18:07
  • There are tools to detect rogue WAPs, but product or resource recommendations are explicitly off-topic here. – Ron Maupin May 27 at 18:24
1

The command arp -a can be used to list the IP addresses and physical addresses of the devices that are on the same network.

No. arp -a lists the MAC-IP associations that are currently in the host cache (from being used previously for L3 traffic).

To find all IP addresses on your network check your DHCP server and/or your network documentation. Alternatively, you can run an ARP sweep (ARP each possible IP address and record the outcome).

is there a way to identify which of these devices is an access point using the IP address (or otherwise)?

Generally not by IP address. An IP address by itself tells you nothing about the device using it.

You could try to compare each MAC address's OUI (first 24 bits) to a vendor list though. Or try reverse DNS lookup. Or try to log into the device (might be classified as hostile act unless it's your network). Or ask the network admin. Or ...

to give more context, what I wanna do is to check for Rogue Access Points by identifying the access points on the network and then compare them to a list of legitimately installed access points.

To detect rogue WAPs and switches, the easiest way is to check for multiple MAC addresses per switch port (which could then be deactivated, depending on the switch in question). Of course, a rogue WAP can also be detected on the wireless side, when it's broadcasting its SSID.

That won't work for NAT routers which can't be easily detected and require considerable traffic analysis to catch.

0

It's probably easier to detect rogue APs from the wireless side, by checking for unknown SSIDs.

Depending on your environment, you could also look for multiple MAC addresses of switch ports. That's not a guarantee, but it may be a clue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.