Find rogue WiFi client

Forum for things that doesn't really have anything to do with hMailServer. Such as php.ini, beer, etc etc.
Post Reply
mikedibella
Normal user
Normal user
Posts: 230
Joined: 2016-12-08 02:21

Find rogue WiFi client

Post by mikedibella » 2020-05-04 21:44

I've got a rogue WiFi client attempting to access my local network. I see the attempts in my RADIUS logs and have captured the MAC address from calling-station-id.

Now I need software (hopefully freeware/freemium/low-cost) to "find" where this client is. I see there is a bunch of free software on the net that lets one walk around and generate heat maps of Access Points, but I 'm having trouble find a good solution to map clients, hopefully once that includes the ability to filter the list by a know MAC address.

Any suggestions?

User avatar
SorenR
Senior user
Senior user
Posts: 3816
Joined: 2006-08-21 15:38
Location: Denmark

Re: Find rogue WiFi client

Post by SorenR » 2020-05-04 22:04

mikedibella wrote:
2020-05-04 21:44
I've got a rogue WiFi client attempting to access my local network. I see the attempts in my RADIUS logs and have captured the MAC address from calling-station-id.

Now I need software (hopefully freeware/freemium/low-cost) to "find" where this client is. I see there is a bunch of free software on the net that lets one walk around and generate heat maps of Access Points, but I 'm having trouble find a good solution to map clients, hopefully once that includes the ability to filter the list by a know MAC address.

Any suggestions?
The only way to locate a "radio" is triangulation. So whatever solution you find you will need 2 mates to help you :mrgreen:

https://www.cisco.com/c/en/us/td/docs/s ... fich2.html
SørenR.

“Those who don't know history are doomed to repeat it.”
― Edmund Burke

User avatar
SorenR
Senior user
Senior user
Posts: 3816
Joined: 2006-08-21 15:38
Location: Denmark

Re: Find rogue WiFi client

Post by SorenR » 2020-05-04 22:12

SørenR.

“Those who don't know history are doomed to repeat it.”
― Edmund Burke

mikedibella
Normal user
Normal user
Posts: 230
Joined: 2016-12-08 02:21

Re: Find rogue WiFi client

Post by mikedibella » 2020-05-04 23:31

Triangulation is one approach, but it requires more than just two reception points. You need a directional antenna or array to isolate the vector of reception in addition to the signal strength to derive a position. It is accurate but too complex for my needs.

Heat mapping, on the other hard, uses a single moving receiver to plot many, many, position/signal pairs and plot them on a map to generate a visual indication of where the strongest detected signal is. The collection process and analysis is a lot simpler. An exact position can only, at best, be inferred, but this is adequate for my needs since I am assuming the rogue device to be relatively static in position when it is in range of my network.

User avatar
jimimaseye
Moderator
Moderator
Posts: 8777
Joined: 2011-09-08 17:48

Re: Find rogue WiFi client

Post by jimimaseye » 2020-05-05 00:15

I reckon it's the bloke in the unironed shirt with the tablet in the white car parked outside.

Just a hunch. :mrgreen:

[Entered by mobile. Excuse my spelling.]
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
johang
Senior user
Senior user
Posts: 341
Joined: 2008-09-01 09:20

Re: Find rogue WiFi client

Post by johang » 2020-05-07 00:31

try macadress block list in wifi accesspoints?

lower your signal strength on the accesspoints..


put up your own rogue wifi accesspoint preferably with a directional antenna.. get outside .. work it outwards from building.. south east north west where do you pick up taht interesting Macadress .. go visit.. ( or just leave the rouge station on .. sending funny packets .. giving him/her access to a honeypot .. lot of things to play with if you feel you have the time )

( make you own directional wifi accesspoint: take a cardboardbox "insulate" with tinfoil at sides and bottom, place wifiaccespoint inside and direct opening of box to where you want your signals to go )
___________________________________________________________end of the line

Post Reply