Automated method and system for monitoring local area computer networks for unauthorized wireless access

A method for monitoring for unauthorized wireless access to computer networks, the method comprising:

• receiving a list of one or more wireless access point devices which are allowed to be connected to a computer network within a selected geographic region, the computer network being at least a portion of a local area computer network to be protected from one or more wireless intrusions;
• positioning one or more sniffer devices within the selected geographic region;
• monitoring wireless communications within the selected geographic region using at least one of the one or more sniffer devices;
• detecting an active wireless access point device from the monitored wireless communications, the active wireless access point device being configured to perform a network address translation function between its wired and wireless interfaces, the active wireless access point device being not among the one or more wireless access point devices which are allowed to be connected to the computer network;
• transmitting a marker packet over a wireless link to the active wireless access point device using at least one of the one or more sniffer devices, the marker packet being adapted to be transferred through the active wireless access point device to an authorized computing device connected to the computer network, the transmitting being at least for determining whether the active wireless access point device is connected to the computer network, the marker packet including a format information identifiable by the authorized computing device;
• determining that the format information is not identified in one or more packets received at the authorized computing device to infer that the marker packet is not received at the authorized computing device;
• and
• determining, based in part on the inferring that the marker packet is not received, that the active wireless access point device does not provide unauthorized wireless access to the computer network while sharing wireless airspace within the selected geographic region with the one or more wireless access point devices which are allowed to be connected to the computer network.

A method for monitoring for unauthorized wireless access to computer networks, the method comprising:

• receiving a list of one or more wireless access points, each of the one or more wireless access points being allowed to be connected to a computer network within a selected geographic region, each of the one or more wireless access points being configured to use one or more security procedures on one or more wireless links associated with it to prevent unauthorized wireless access through it, the computer network being at least a portion of a local area computer network to be protected from one or more wireless intrusions;
• positioning one or more sniffer devices within the selected geographic region;
• monitoring wireless communications within the selected geographic region using a first sniffer device from the one or more sniffer devices;
• detecting an active wireless access point from the monitored wireless communications, the active wireless access point being configured to perform a network address translation function between its wired and wireless interfaces;
• transmitting a marker packet over a wireless link to the active wireless access point using a second sniffer device from the one or more sniffer devices, the marker packet being adapted to be transferred through the active wireless access point to an authorized computing device connected to the computer network, the transmitting being at least for determining whether the active wireless access point is connected to the computer network;
• determining that the marker packet is received at the computing device connected to the computer network;
• and
• determining that the active wireless access point provides unauthorized wireless access to the computer network based at least upon the determining that the marker packet is received at the authorized computing device connected to the computer network.

A method for monitoring for unauthorized wireless access to computer networks, the method comprising:

• receiving a list of one or more wireless access points, each of the one or more wireless access points being allowed to be connected to a computer network within a selected geographic region, each of the one or more wireless access point devices being configured to use one or more security procedures on one or more wireless links associated with it to prevent unauthorized wireless access through it, the computer network being at least a portion of a local area computer network to be protected from one or more wireless intrusions;
• positioning one or more sniffer devices within the selected geographic region;
• monitoring wireless communications within the selected geographic region using at least one of the one or more sniffer devices;
• detecting an active wireless access point from the monitored wireless communications, the active wireless access point being configured to perform a network address translation function between its wired and wireless interfaces, the active wireless access point being configured to not use any security procedures on one or more wireless links associated with it to prevent unauthorized wireless access through it;
• transmitting a marker packet over a wireless link to the active wireless access point using at least one of the one or more sniffer devices, the marker packet being adapted to be transferred through the active wireless access point to an authorized computing device connected to the computer network, the transmitting being at least for determining whether the active wireless access point is connected to the computer network;
• determining that the marker packet is not received at the computing device connected to the computer network;
• and
• determining, based in part on the determining that the marker packet is not received, that the active wireless access point does not provide unauthorized wireless access to the computer network while sharing wireless airspace within the selected geographic region with the one or more wireless access point which are allowed to be connected to the computer network.

A computer based system for monitoring unauthorized wireless access to computer networks, the system comprising:

• a first wireless communication interface to receive one or more wireless signals within its vicinity;
• a second wireless communication interface to transmit one or more wireless signals within its vicinity;
• and
• one or more computer memories, the one or more computer memories comprising:
• one or more codes directed to receiving information associated with a feature set associated with an authorized wireless access point device, the authorized wireless access point device being allowed to be connected to a computer network within a selected geographic region, the computer network being at least a portion of a local area computer network to be protected from one or more wireless intrusions;
• one or more codes directed to processing information associated with the one or more wireless signals received using the first wireless communication interface to identify an active wireless access point device and to identify a feature set associated with the active wireless access point device;
• one or more codes directed to transmitting a marker packet over a wireless link to the active wireless access point device using the second wireless communication interface, the marker packet being adapted to be transferred through the active wireless access point device to an authorized computing device connected to the computer network, the transmitting being at least for determining whether the active wireless access point device is connected to the computer network, the marker packet including a format information identifiable by the authorized computing device;
• one or more codes directed to identifying the format information in a packet received at the authorized computing device to infer that the received packet is the marker packet;
• and
• one or more codes directed to determining that the active wireless access point device provides unauthorized wireless access to the computer network based at least upon the inferring that the marker packet is received at the authorized computing device connected to the computer network.