cancel
Showing results for 
Search instead for 
Did you mean: 

Strategies needed to identify mac spoofing rogue devices

donald_curry_58
New Contributor III
Need help Identifying MAC Spoofing Rogues. I have a customer with a zone director showing MAC Spoofing Rogues with MACs 24:c9:a1:49:2c:9c and 24:c9:a1:09:2c:9c. Obviously none of the ZF7055 AP's at this site have that exact MAC, but the Spoof is being detected by a ZF7055.
1 REPLY 1

bill_burns_6069
Contributor III
I assume you mean: how do you identify "malicious" wifi clients that have cloned the mac addresses of other authorized clients.

This can happen in MAC auth bypass scenarios.

One way to deal with this is by using a product/service like nessus.
For example, if you were using packetfence to onboard / "authenticate" / register devices on your network, you could integrate packetfence with nessus.

Nessus would create a "fingerprint" of the wifi client, and (hopefully) detect that the identity of the client using that mac address/IP had changed on a subsequent scan.