Tried Arpwatch and Port Security on switches? If you really want to prevent any
APs being plugged into any network above will certainly help, but of course
depends highly on the infrastructure in place (managed or unmanaged switches,
hubs in use etc.). NMAP scanning could also identify an AP, but its also easily
circumvented and one can do naughty things to fool nmap and making it believe
its a Windows Workstation or so, but also here it depends on the Hardware used.
And to detect any other Wireless device is a bit tricky. You can't rely on the
fact that you see the affected office only and you might pick up signals from
the outside and start chasing ghosts. To prevent this you would need to shield
the entire office against any radiation from the outside, which is a bit costly
to be honest.
I know that we have only two APs in use in our office, but i pick about 8 APs
from the outside up (7 of them fully open and unprotected, 2 of them in
positively identified offices and allowing unrestricted access to internal and
external resources). I also can pick loads of PCs and Workstations up in this
area here. So as i said it is almost impossible to identify where a Wireless
client is coming from, especially from remote locations as in your scenario.
I know port security is a pain in the back, especially if you have an ever
changing environment, but it seems to be the only feasable solution. And of
course pointing to security policies and threatening with disciplinary action
against anybody who plugs anything unauthorized into a network can help as well.
Hope this helps
Tom
-------------------------------------------------------------------------
This List Sponsored by: Webroot
Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise
http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------
