Method and apparatus for detecting a rogue access point in a communication network
A method and apparatus for detecting a rogue access point in a communication network is described herein. The method includes a probing unit sending a pre-detection message to an associated access point in the communication network. The pre-detection message indicates a start of rogue access point detection mode and informs the associated access point not to respond to probe requests following the pre-detection message. The method further includes the probing unit broadcasting probe requests in the communication network. The probing unit detect that one or more of the plurality of access points is the rogue access point based on receiving a probe response in reply to the broadcasted probe request from the rogue access point. A method for detecting a rogue access point includes broadcasting a probe request with a proprietary information bit and detecting the rogue access point based on receiving a probe response for the broadcasted probe request.
1. A method for detecting a rogue access point in a communication network comprising a probing unit authorized in the network, a plurality of client devices, and a plurality of access points, the method comprising:
operating the probing unit to:
associate with at least one of the plurality of access points, wherein the associated access point is an authorized access point in the communication network;
send a pre-detection message to the associated access point, wherein the pre-detection message indicates a start of rogue access point detection mode and informs the associated access point not to respond to at least one of a plurality of probe requests following the pre-detection message;
broadcast at least one probe request in the communication network after sending the pre-detection message and during the detection mode, wherein authorized access points in the plurality of access points being previously instructed to not to respond to the at least one probe request; and
detect that one or more of the plurality of access points is the rogue access point based on receiving a probe response in reply to the broadcasted probe request from the rogue access point during the detection mode.
2. The method of claim 1 further comprising:
sending, by the associated access point, the pre-detection message to the other plurality of access points authorized to the communication network and informing the other plurality of authorized access points not to respond to at least one probe request following the pre-detection message.
3. The method of claim 2 further comprising:
operating the probing unit to:
send a post-detection message to the associated access point indicating end of rogue access point detection mode.
4. The method of claim 3 further comprising:
sending, by the associated access point, the post-detection message to the other plurality of authorized access points indicating the end of rogue access point detection mode.
5. The method of claim 4 , wherein the pre-detection message and the post-detection message are proprietary messages specific to the communication network.
6. The method of claim 1 further comprising:
operating the probing unit to:
determine whether a predetermined time period expires when no probe response is received; and
send a post-detection message when the predetermined time period expires and when no probe response is detected.
7. The method of claim 3 , wherein the plurality of access points operate in a normal mode outside of the detection mode.
8. The method of claim 1 , wherein the probing unit includes at least one of the plurality of client devices in the communication network.
9. The method of claim 1 , wherein the probing unit includes at least one of the plurality of access points operating in a probe mode.
10. A method for detecting a rogue access point in a communication network comprising a probing unit authorized in the network, a plurality of client devices, and a plurality of access points, the method comprising:
operating an authorized plurality of access points to:
receive a pre-detection message from the probing unit associated with the at least one access point, wherein the pre-detection message indicates a start of rogue access point detection mode and informs the authorized access points not to respond to at least one of a plurality of probe requests following the pre-detection message;
receive at least one of a plurality of probe requests broadcast by the probing unit after receiving the pre-detection message and during the detection mode;
refrain from responding to probe requests during the detection mode.
11. The method of claim 10 further comprising:
operating the at least one access point to:
respond to probe requests after a post-detection message is received.
12. The method of claim 10 , wherein the plurality of access points operate in a normal mode outside of the detection mode.