A rogue AP is not part of the corporate infrastructure. It could be an AP that's been brought in from home or an AP that's in a neighboring network. A rogue AP is not always bad. It could be an AP that's part of the corporate domain yet still operating in autonomous mode. Part of an administrator's job is determining if the AP is supposed to be there. Fortunately, you don't have to do all the work yourself. A few functions of the AP's software can detect rogue APs and even indicate if they are on your network.
Something to consider when looking for rogue APs is what happens to clients that can connect to those rogue APs. If a client connects to a rogue AP, it should be considered a rogue client. The reason is that rogue APs typically are installed with default configurations, meaning that any client that connects bypasses any corporate security policy. So you do not know if the client is a corporate user or an attacker.
Was this article helpful?