Automated sniffer apparatus and method for monitoring computer systems for unauthorized access

A system for monitoring for unauthorized wireless access to computer networks, the system comprising:

• a wired network interface for coupling the system to a wired portion of a computer network;
• a first portion of computer memory coupled to the wired network interface, the first portion of computer memory comprising computer-readable code executable to inject one or more marker packets into the wired portion of the computer network using the wired network interface at least for a purpose of detecting unauthorized access to the wired portion, the one or more marker packets being adapted to be transferred to a wireless medium from the wired portion of the computer network through one or more wireless access point devices which are connected to the wired portion of the computer network and function as layer two bridges between their wired and wireless interfaces, a predetermined format being associated with the one or more marker packets;
• a wireless network interface for monitoring wireless communication activity;
• a second portion of computer memory coupled to the wireless network interface, the second portion of computer memory comprising computer-readable code executable to identify, based on the monitored wireless communication activity, at least one marker packet from the one or more marker packets that was transferred to the wireless medium from the wired portion of the computer network through a first wireless access point device;
• a third portion of computer memory comprising computer-readable code executable to determine that the first wireless access point device is connected to the wired portion of the computer network, based at least upon the at least one marker packet being identified as transferred to the wireless medium from the wired portion of the computer network through the first wireless access point device;
• a fourth portion of computer memory comprising computer-readable code executable to determine that the first wireless access point is unauthorized;
• and
• a fifth portion of computer memory comprising computer-readable code executable to determine unauthorized access to the wired portion of the computer network based at least upon the determination that the first wireless access point device is connected to the wired portion of the computer network and the determination that the first wireless access point is unauthorized.

A method for monitoring unauthorized wireless access to a network, the method comprising:

• monitoring wireless communications in the network by one or more monitoring devices, wherein the network comprises a wired portion and a wireless medium;
• detecting a wireless access point that transmits wireless signals over the wireless medium in the network;
• injecting a marker packet into the wired potion of the network at least for a purpose of detecting unauthorized access to the wired portion;
• determining that the wireless access point is connected to the wired portion of the network if at least one of the monitoring devices detects that the marker packet was transferred from the wired portion to the wireless medium of the network through the wireless access point;
• determining that the wireless access point is unauthorized;
• and
• determining that the wireless access point provides unauthorized access to the wired portion of the network based upon the determination that the wireless access point is unauthorized and is connected to the wired portion of the network.