Detecting and disabling rogue access points in a network
View Patent ↗A rogue access point in a wireless local-area network can be disabled by an authorized access point wirelessly transmitting a layer-2 broadcast packet. If a rogue access point receives this broadcast packet, it will forward a copy to the switch to which it is connected. The switch then determines whether the port on which the copy of the broadcast packet is received is associated an authorized access point port. If the switch determines the port is not an authorized access point port, the switch shuts down the port.
1. A method for disabling an access point in a wireless local-area network, comprising:
a first access point originating a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmitting the broadcast packet;
a network switch receiving a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch;
the network switch determining in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port; and
the network switch shutting down the port if the network switch determines the port is not an authorized access point port.
2. The method of claim 1 , further comprising:
the first access point monitoring for detection of an identifier transmitted by the second access point;
wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point.
3. The method of claim 2 , further comprising:
the first access point comparing a detected identifier transmitted by the second access point with a list of authorized identifiers; and
the first access point determining whether the detected identifier is an authorized identifier;
wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier.
4. The method of claim 1 , further comprising the network switch discarding the forwarded copy of the broadcast packet.
5. The method of claim 1 , further comprising:
the first access point wirelessly receiving another broadcast packet;
the first access point determining whether the another broadcast packet contains the tag; and
the first access point discarding the another broadcast packet if the another broadcast packet is determined to contain the tag.
6. A system for disabling an access point in a wireless local-area network, comprising:
a first access point configured to originate a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmit the broadcast packet; and
a network switch configured to receive a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch, the network switch further configured to determine in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port and to shut down the port if the network switch determines the port is not an authorized access point port.
7. The system of claim 6 , wherein:
the first access point is further configured to monitor for detection of an identifier transmitted by the second access point; and
the first access point is further configured to be triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point.
8. The system of claim 6 , further comprising:
the first access point comparing a detected identifier transmitted by the second access point with a list of authorized identifiers; and
the first access point determining whether the detected identifier is an authorized identifier;
wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier.
9. The system of claim 6 , wherein the network switch is further configured to discard the forwarded copy of the broadcast packet.
10. The system of claim 6 , wherein:
the first access point is further configured to wirelessly receive another broadcast packet;
the first access point is further configured to determine whether the another broadcast packet contains the tag; and
the first access point is further configured to discard the another broadcast packet if the another broadcast packet is determined to contain the tag.
11. A computer program product for disabling an access point in a wireless local-area network, the computer program product comprising computer-readable media having stored thereon in non-transitory computer-readable form:
broadcast packet transmit logic for configuring a first access point to originate a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmit the broadcast packet;
broadcast packet receive logic for configuring a network switch to receive a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch;
port authorization check logic for configuring the network switch to determine in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port; and
port shutdown logic for configuring the network switch to shut down the port if the network switch determines the port is not an authorized access point port.
12. The computer program product of claim 11 , further comprising:
identifier detection logic for configuring the first access point to monitor for detection of an identifier transmitted by the second access point;
wherein the broadcast packet transmit configures the first access point to be triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point.
13. The computer program product of claim 12 , further comprising:
identifier comparison logic for configuring the first access point to compare a detected identifier transmitted by the second access point with a list of authorized identifiers and determine whether the detected identifier is an authorized identifier;
wherein the broadcast packet transmit configures the first access point to be triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier.
14. The computer program product of claim 11 , further comprising packet discard logic for configuring the network switch to discard the forwarded copy of the broadcast packet.
15. The computer program product of claim 11 , further comprising
broadcast packet receive logic for configuring the first access point to wirelessly receive another broadcast packet;
tag check logic for configuring the first access point to determine whether the another broadcast packet contains the tag; and
packet discard logic for configuring the first access point to discard the another broadcast packet if the another broadcast packet is determined to contain the tag.