Wireless Access

we are seeing much of wireless bridge detection in our environment those are detected by IDS my question is how can we track down that wireless bridge location  just to see if it exixt inside our network. may be someone is turning is wireless hotspot on their with softwares like connectify etc and bridges are geting detected.

Thanks for help in advance.

When it says that a wireless bridge is detected, it also says which access point hears it.  Start looking near that access point.

right but from controller point of view how can we check , reason behind is AP's are at remote location any specific command with help of which we can check .

thanks for help

Can we do it with the help of map. I mean if you upload RF plan in the controller???

You need at least 3 access points on a map, unfortunately, to triangulate a device...

in my experience, on a remote site, you either dispatch a technician to investigate or have someone onsite look for you around the AP that had discovered it.

On the controller you can run 'show wms ap list', 'show log security'. Amongst other commands to see what is going on.

If you have Airwave, you can look at the RAPIDS IDS Events list and find the particular Wireless Bridge Event to investigate further.

You can then run more detailed commands on the user's MAC, etc..

But if you can get hands-on on site, it would be best imo

Issue is mac address is always changing  and when trying to search mac dont see it on airwave,