# US 9,439,131 B2 · Detecting and disabling rogue access points in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,439,131 B2 - Document ID: US9439131B2 - Status: Granted - Kind: B2 - Application number: 14/276,332 - Filed: 2014-05-13 - Published: 2015-11-19 - Granted: 2016-09-06 - Earliest claimed: 2014-05-13 - Assignees: Adtran, Inc. - Applicants: Adtran, Inc. - Inventors: Mark C. Rudolph; Timothy James Schlichter; Thomas F. Guevin - Web page: https://patentgrep.com/patent/US9439131B2 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 48/02: Access restriction performed under specific conditions - H04W 8/20: Transfer of user or subscriber data - H04W 8/24: Transfer of terminal data - H04W 12/12: Detection or prevention of fraud - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/162: {at the data link layer} - H04W 12/73: Access point logical identity - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A rogue access point in a wireless local-area network can be disabled by an authorized access point wirelessly transmitting a layer-2 broadcast packet. If a rogue access point receives this broadcast packet, it will forward a copy to the switch to which it is connected. The switch then determines whether the port on which the copy of the broadcast packet is received is associated an authorized access point port. If the switch determines the port is not an authorized access point port, the switch shuts down the port. ## Claims ### Claim 1 A method for disabling an access point in a wireless local-area network, comprising: a first access point originating a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmitting the broadcast packet; a network switch receiving a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch; the network switch determining in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port; and the network switch shutting down the port if the network switch determines the port is not an authorized access point port. ### Claim 2 (depends on 1) The method of claim 1, further comprising: the first access point monitoring for detection of an identifier transmitted by the second access point; wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point. ### Claim 3 (depends on 2) The method of claim 2, further comprising: the first access point comparing a detected identifier transmitted by the second access point with a list of authorized identifiers; and the first access point determining whether the detected identifier is an authorized identifier; wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier. ### Claim 4 (depends on 1) The method of claim 1, further comprising the network switch discarding the forwarded copy of the broadcast packet. ### Claim 5 (depends on 1) The method of claim 1, further comprising: the first access point wirelessly receiving another broadcast packet; the first access point determining whether the another broadcast packet contains the tag; and the first access point discarding the another broadcast packet if the another broadcast packet is determined to contain the tag. ### Claim 6 A system for disabling an access point in a wireless local-area network, comprising: a first access point configured to originate a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmit the broadcast packet; and a network switch configured to receive a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch, the network switch further configured to determine in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port and to shut down the port if the network switch determines the port is not an authorized access point port. ### Claim 7 (depends on 6) The system of claim 6, wherein: the first access point is further configured to monitor for detection of an identifier transmitted by the second access point; and the first access point is further configured to be triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point. ### Claim 8 (depends on 6) The system of claim 6, further comprising: the first access point comparing a detected identifier transmitted by the second access point with a list of authorized identifiers; and the first access point determining whether the detected identifier is an authorized identifier; wherein the first access point is triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier. ### Claim 9 (depends on 6) The system of claim 6, wherein the network switch is further configured to discard the forwarded copy of the broadcast packet. ### Claim 10 (depends on 6) The system of claim 6, wherein: the first access point is further configured to wirelessly receive another broadcast packet; the first access point is further configured to determine whether the another broadcast packet contains the tag; and the first access point is further configured to discard the another broadcast packet if the another broadcast packet is determined to contain the tag. ### Claim 11 A computer program product for disabling an access point in a wireless local-area network, the computer program product comprising computer-readable media having stored thereon in non-transitory computer-readable form: broadcast packet transmit logic for configuring a first access point to originate a broadcast packet containing a unique tag independently of operation of any network devices in wired communication with the first access point and wirelessly transmit the broadcast packet; broadcast packet receive logic for configuring a network switch to receive a forwarded copy of the broadcast packet from a second access point connected via a wired connection to a port of the network switch; port authorization check logic for configuring the network switch to determine in response to receipt of the forwarded copy of the broadcast packet whether the port is an authorized access point port; and port shutdown logic for configuring the network switch to shut down the port if the network switch determines the port is not an authorized access point port. ### Claim 12 (depends on 11) The computer program product of claim 11, further comprising: identifier detection logic for configuring the first access point to monitor for detection of an identifier transmitted by the second access point; wherein the broadcast packet transmit configures the first access point to be triggered to originate and wirelessly transmit the broadcast packet in response to detection of the identifier transmitted by the second access point. ### Claim 13 (depends on 12) The computer program product of claim 12, further comprising: identifier comparison logic for configuring the first access point to compare a detected identifier transmitted by the second access point with a list of authorized identifiers and determine whether the detected identifier is an authorized identifier; wherein the broadcast packet transmit configures the first access point to be triggered to originate and wirelessly transmit the broadcast packet by determining that the identifier transmitted by the second access point is not an authorized identifier. ### Claim 14 (depends on 11) The computer program product of claim 11, further comprising packet discard logic for configuring the network switch to discard the forwarded copy of the broadcast packet. ### Claim 15 (depends on 11) The computer program product of claim 11, further comprising broadcast packet receive logic for configuring the first access point to wirelessly receive another broadcast packet; tag check logic for configuring the first access point to determine whether the another broadcast packet contains the tag; and packet discard logic for configuring the first access point to discard the another broadcast packet if the another broadcast packet is determined to contain the tag.