Strategies needed to identify mac spoofing rogue devices

[donald_curry_58]

Need help Identifying MAC Spoofing Rogues. I have a customer with a zone director showing MAC Spoofing Rogues with MACs 24:c9:a1:49:2c:9c and 24:c9:a1:09:2c:9c. Obviously none of the ZF7055 AP's at this site have that exact MAC, but the Spoof is being detected by a ZF7055.

[bill_burns_6069]

I assume you mean: how do you identify "malicious" wifi clients that have cloned the mac addresses of other authorized clients.

This can happen in MAC auth bypass scenarios.

One way to deal with this is by using a product/service like nessus.
For example, if you were using packetfence to onboard / "authenticate" / register devices on your network, you could integrate packetfence with nessus.

Nessus would create a "fingerprint" of the wifi client, and (hopefully) detect that the identity of the client using that mac address/IP had changed on a subsequent scan.