WIRELESS / ACCESS POINT REVIEW
Investigating a suspected rogue access point
A suspicious SSID or BSSID is a lead to investigate. Start with the monitored site and the observation time, then compare the advertised network with the site inventory. Atheros Sensor raises configured indicators. Atheros Search helps review the observations behind them.
Record what the sensor could observe
Passive capture requires Linux, monitor-mode Wi-Fi hardware, and configured channels. Establish authorization, collection scope, access and retention arrangements before capture. Record sensor location, interface, time range and channel coverage, and use an up-to-date authorized-network list for that site.
- A sensor observing channel 6 cannot establish that nothing happened on unmonitored channels.
- The detector reviews beacon and probe-response observations. An advertised network name alone does not establish a client connection.
- Record maintenance windows, managed AP changes and the age of the authorized inventory alongside the observation.
- MAC randomization and spoofing prevent an observed address from establishing a physical device identity. Corroborate a lead against site inventory and independent evidence.
- This example does not establish WPA3, 6 GHz, or multi-link coverage. Record the hardware, driver, band and frame types actually observed before extending a conclusion to those environments.
Follow a synthetic SSID discrepancy
In this constructed example, the site inventory lists LabNet as an authorized network. The two rows are educational observation summaries, not sensor payloads or production records.
Configured known SSID: LabNet
Observed SSID: LabNet
Observed security_flags: 0
Review reason: open_authorized_ssidThis matches the implementation condition: a known SSID with security_flags equal to zero. It is a reason to inspect the evidence, not an incident verdict.
| Time (UTC) | SSID | BSSID | Channel | Observed security |
|---|---|---|---|---|
| 2026-10-08 10:00:00 | LabNet | 02:00:00:00:00:10 | 6 | Encryption advertised |
| 2026-10-08 10:00:05 | LabNet | 02:00:00:00:00:20 | 6 | No encryption advertised |
Review the indicator against the supporting observations
Scope the review to lab-west and the observation interval. Inspect the beacon or probe-response fields and related records for each BSSID. Preserve the source keys, timestamps and detector reasons so another analyst can follow the same evidence.
- Check the configured network list: was an open guest network, temporary AP or recent controller change omitted?
- Compare the AP inventory and maintenance history. An SSID shared by multiple BSSIDs can be expected in a managed deployment.
- Review related observations before deciding whether the pattern persists. The detector also has reasons for similar SSIDs, changed BSSID-to-SSID mappings, and channel or vendor conflicts. Each reason needs its own context.
- Use location or device identity suggestions as review candidates. Do not turn an observed address into a confirmed owner or physical asset.
Document uncertainty as part of the finding
A useful investigation note states the site, time window, observed fields, triggered reason, inventory comparison and unresolved questions. A possible explanation such as maintenance must be corroborated rather than assumed.
Site: lab-west
Window: 10:00:00-10:00:05 UTC
Lead: known SSID LabNet observed without advertised encryption
Evidence: BSSID 02:00:00:00:00:20, channel 6
Inventory check: unresolved. Ask the site owner to confirm AP changes
Conclusion: review candidate. No connection or device identity confirmedAn example of recording the evidence boundary. No message is sent by this guide.
- Capture placement, missed frames and incomplete channel coverage can leave gaps.
- A stale authorized list or a legitimate configuration change can explain a lead. Close the finding only after recording the supporting check.
Source code
The implementation behind the examples. Examples are educational inputs, not production records or measured results.
- Rogue access point detection conditions
Known open SSIDs, similar names, mapping changes and conflict reasons are heuristic leads.
- Sensor capture and configuration
Monitor-mode prerequisites and configured capture scope.
- Search review surfaces
Search, inventory and record explanation capabilities.