Skip to main content
The Wireless Rogue Detector lists the Wi-Fi networks each beacon can see from where it runs. They are collected passively from the beacon host’s own wireless interface, with no association and no attack, during the normal discovery sweep. Each network carries its access point, vendor, band, channel, security and signal strength. Three kinds are flagged:
  • Likely evil twin: a network name the client uses, broadcast from a second access point, an unknown vendor or with weaker security than the original.
  • Open networks: no encryption at all.
  • Weak encryption: security that is out of date or easy to break.

Reading the page

Six tiles open the page: networks heard, evil-twin watch, open, weak encryption, WPA2 or WPA3, and bands. When a network name is heard from more than one radio, a card above the list names it and lists every radio broadcasting it, with its hardware address (BSSID), vendor, band and channel and signal bars. Check each against the client’s own access points: the one they never deployed is the rogue, and a strong signal means it is close to the beacon. Filter the list to Flagged networks or to one band, or search by name, BSSID, vendor, security or channel. Signal shows as bars beside the dBm value, and last seen as a relative time. Flagged networks are filed as internal findings for review, each with the methodology to confirm it on site, and appear in the Asset Mapping Report under wireless rogue access points.
The beacon host needs a wireless interface for this page to show anything. A beacon on a wired-only server still maps the network; it just cannot see the air.