# US 12,192,770 B2 · Identifying rogue wireless devices using MAC address rotation techniques > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,770 B2 - Document ID: US12192770B2 - Status: Granted - Kind: B2 - Application number: 17/731,689 - Filed: 2022-04-28 - Published: 2023-11-02 - Granted: 2025-01-07 - Earliest claimed: 2022-04-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Domenico Ficara; Roberto Muccifora; Amine Choukir; Robert Barton; Jerome Henry; Arun Khanna - Web page: https://patentgrep.com/patent/US12192770B2 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/106: Packet or message integrity - H04W 12/73: Access point logical identity - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method is provided that is performed in a wireless network to detect a rogue wireless device. The method comprises detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network. When a suspect wireless device is detected, the method next includes sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address. After the valid wireless device has changed its MAC address, the method involves observing messages transmitted by the suspect wireless device in the wireless network. The method then includes determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address. ## Claims ### Claim 1 A method performed in a wireless network to detect a rogue wireless device, the method comprising: detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network; sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address, wherein the request is a wireless message sent using the first MAC address configured to cause the valid wireless device to change its MAC address to a new valid MAC address in order to reveal the suspect wireless device as a rogue device, wherein the new valid MAC address is selected from a valid un-attackable set of MAC addresses; after the valid wireless device has changed its MAC address, observing messages transmitted by the suspect wireless device in the wireless network; and determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address. ### Claim 2 (depends on 1) The method of claim 1, wherein the valid wireless device is a valid access point and the suspect wireless device is a rogue access point. ### Claim 3 (depends on 2) The method of claim 2, wherein the request is a wired network message sent to the valid access point. ### Claim 4 (depends on 2) The method of claim 2, wherein the request is a wireless message sent in a protected format between access points. ### Claim 5 (depends on 1) The method of claim 1, wherein the valid wireless device is a valid wireless client device and the suspect wireless device is a rogue client device. ### Claim 6 (depends on 5) The method of claim 5, wherein the request is a wireless message sent in a protected format. ### Claim 7 (depends on 5) The method of claim 5, wherein the request is a wireless message configured to cause the valid wireless client device to change its MAC address to new valid MAC address selected based on previously shared information with the valid wireless client device. ### Claim 8 (depends on 7) The method of claim 7, wherein the previously shared information is one of: the valid un-attackable sequence or set of next MAC addresses from which the valid wireless client device selects a MAC address; a shared secret with which the valid wireless client device selects a MAC address based on a function of the shared secret; or a set of MAC addresses provided to the valid wireless client device during an initial connection between a wireless access point and the valid wireless client device, from which set of MAC addresses the valid wireless client device selects a MAC address. ### Claim 9 (depends on 1) The method of claim 1, further comprising including with the request, a timer value indicating a time period by which the valid wireless device is to change its MAC address. ### Claim 10 (depends on 9) The method of claim 9, further comprising disabling wireless network connectivity of the suspect wireless device after the time period has elapsed. ### Claim 11 An apparatus comprising: one or more network interfaces that enable network communication including communication with one or more access points that serve one or more client devices in a wireless network; and at least one processor coupled to the one or more network interfaces, the at least one processor configured to perform operations including: detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network; causing to be sent to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address, wherein the request is a wireless message sent using the first MAC address configured to cause the valid wireless device to change its MAC address to a new valid MAC address in order to reveal the suspect wireless device as a rogue device, wherein the new valid MAC address is selected from a valid un-attackable set of MAC addresses; after the valid wireless device has changed its MAC address, observing messages transmitted by the suspect wireless device in the wireless network; and determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the valid wireless device is a valid access point and the suspect wireless device is a rogue access point, and wherein the request is a wired network message sent to the valid access point or a wireless message sent in a protected format between access points. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the valid wireless device is a valid wireless client device and the suspect wireless device is a rogue client device. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the request is a wireless message configured to cause the valid wireless client device to change its MAC address to a new valid MAC address selected based on previously shared information with the valid wireless client device. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the previously shared information is one of: the valid un-attackable sequence or set of next MAC addresses from which the valid wireless client device selects a MAC address; a shared secret with which the valid wireless client device selects a MAC address based on a function of the shared secret; or a set of MAC addresses provided to the valid wireless client device during an initial connection between a wireless access point and the valid wireless client device, from which set of MAC addresses the valid wireless client device selects a MAC address. ### Claim 16 One or more non-transitory computer readable media encoded with instructions that, when executed by a processor, cause the processor to perform operations for a wireless network to detect a rogue wireless device, the operations including: detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network; sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address, wherein the request is a wireless message sent using the first MAC address configured to cause the valid wireless device to change its MAC address to a new valid MAC address in order to reveal the suspect wireless device as a rogue device, wherein the new valid MAC address is selected from a valid un-attackable set of MAC addresses; after the valid wireless device has changed its MAC address, observing messages transmitted by the suspect wireless device in the wireless network; and determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address. ### Claim 17 (depends on 16) The one or more non-transitory computer readable media of claim 16, wherein the valid wireless device is a valid access point and the suspect wireless device is a rogue access point, and wherein the request is a wired network message sent to the valid access point or a wireless message sent in a protected format between access points. ### Claim 18 (depends on 16) The one or more non-transitory computer readable media of claim 16, wherein the valid wireless device is a valid wireless client device and the suspect wireless device is a rogue client device. ### Claim 19 (depends on 18) The one or more non-transitory computer readable media of claim 18, wherein the request is a wireless message configured to cause the valid wireless client device to change its MAC address to a new valid MAC address selected based on previously shared information with the valid wireless client device. ### Claim 20 (depends on 19) The one or more non-transitory computer readable media of claim 19, wherein the previously shared information is one of: the valid un-attackable sequence or set of next MAC addresses from which the valid wireless client device selects a MAC address; a shared secret with which the valid wireless client device selects a MAC address based on a function of the shared secret; or a set of MAC addresses provided to the valid wireless client device during an initial connection between a wireless access point and the valid wireless client device, from which set of MAC addresses the valid wireless client device selects a MAC address.