Strategies needed to identify mac spoofing rogue devices

donald_curry_58 — Fri, 04 Oct 2013 16:20:09 GMT

Need help Identifying MAC Spoofing Rogues. I have a customer with a zone director showing MAC Spoofing Rogues with MACs 24:c9:a1:49:2c:9c and 24:c9:a1:09:2c:9c. Obviously none of the ZF7055 AP's at this site have that exact MAC, but the Spoof is being detected by a ZF7055.

Re: Strategies needed to identify mac spoofing rogue devices

bill_burns_6069 — Thu, 09 Jan 2014 19:14:13 GMT

I assume you mean: how do you identify "malicious" wifi clients that have cloned the mac addresses of other authorized clients.

This can happen in MAC auth bypass scenarios.

One way to deal with this is by using a product/service like nessus.
For example, if you were using packetfence to onboard / "authenticate" / register devices on your network, you could integrate packetfence with nessus.

Nessus would create a "fingerprint" of the wifi client, and (hopefully) detect that the identity of the client using that mac address/IP had changed on a subsequent scan.

topic Strategies needed to identify mac spoofing rogue devices in Access Points - Indoor and Outdoor

Strategies needed to identify mac spoofing rogue devices

Re: Strategies needed to identify mac spoofing rogue devices