Inbound time stamping for detecting rogue access point

• Main Authors: Ahmad, Amran, Hassan, Suhaidi, Omar, Mohd Hasbullah
• Format: Conference or Workshop Item
• Language: English
• Published: 2013
• Subjects: QA76 Computer software
• Online Access: http://repo.uum.edu.my/11997/1/PID113.pdf; http://repo.uum.edu.my/11997/; http://www.icoci.cms.net.my/proceedings/2013/TOC.html

Rogue Access Point (RAP) is a network vulnerability phenomenon of improper usage of wireless Access Point unknown to an organizational network engineer.Once it is inside the subnet or Local Area Network (wired structure) then we need to rectify of its availability.The process of rectifying can be classified into passive monitoring, using visualization and traffic characteristic.We prefer traffic characteristic scanning where a packet capturing can become one of the best tools to differentiate between wired and wireless network.Our main concentration is time stamping as a value added to packet capturing for wired and wireless differentiation.The time stamping is done at two point inbound inside subnet focusing on a PAYLOAD and its ACK using network test bed measured by finding an average of 100 PAYLOAD-ACK pairs.The test show about 16 to 56 percent differences between wired and wireless g mode and 15 to 26 percent differences between wired and wireless n mode.As a result, it shows that there is more delay on wireless than the wired and easier for us to detect RAP existence in wired network.