(Credit to fellow ISC handler Richard Porter for the idea given to someone who e-mailed in looking for ways to detect rogue APs)

Most organizations have policies to disallow wireless access points not controlled by the organization which then requires trying to find such devices when they crop up.  There are commercial devices that can be deployed to do this and you could always have someone do a walkthrough with a laptop.  However, there are some network tricks you can use to provide another "dirty" detection method.

If rogue APs are plugged into your network, they will decrease the TTL value in all packets by one that traverse through the access point.  This can make it easy to detect the presence of those by using p0f/tcpdump/snort to look for packets that have TTL values that are lower than expected.  This also works for unauthorized routers, virtual images, bad network stack configurations, etc.  It won't detect APs that aren't plugged into your network and has some gaps (for instance, a savvy individual could modify the TTL they use before sending packets out), but again it is a "dirty" method of detection.  The advantage of looking for bad "TTLs" is that you will also have advance detection of network problems as well.

You can profile your network and find legitimate TTL values by running tcpdump -v and verifying the information with a network diagram (each router, NAT device, etc will lower TTL by 1).

--
John Bambenek
Bambenek Consulting
bambenek at gmail /dot/ com