Identifying rogue wireless devices using MAC address rotation techniques

An apparatus comprising:

• one or more network interfaces that enable network communication including communication with one or more access points that serve one or more client devices in a wireless network;
• and
• at least one processor coupled to the one or more network interfaces, the at least one processor configured to perform operations including:
• detecting a suspect wireless access point device in the wireless network based on messages transmitted by the suspect wireless access point device using a first Media Access Control (MAC) address that is also used by a valid wireless access point device in the wireless network;
• causing to be sent to the valid wireless access point device in the wireless network a request configured to cause the valid wireless access point device to change its MAC address, wherein the request is configured to cause the valid wireless access point device to change its MAC address to a new valid MAC address, wherein the request includes a timer value indicating a time period by which the valid wireless access point device is to change its MAC address;
• after the valid wireless access point device has changed its MAC address, observing messages transmitted by the suspect wireless access point device in the wireless network;
• determining that the suspect wireless access point device is a rogue device when the suspect wireless access point device continues to transmit messages using the first MAC address;
• and
• restricting the suspect wireless access point device when it is determined to be a rogue device or the time period has elapsed.

A method performed in a wireless network to detect a rogue wireless device, the method comprising:

• detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network;
• sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address, wherein included within the request is a timer value indicating a time period by which the valid wireless device is to change its MAC address;
• after the valid wireless device has changed its MAC address, observing messages transmitted by the suspect wireless device in the wireless network;
• determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address;
• and
• restricting the suspect wireless device when it is determined to be a rogue device or the time period has elapsed.