The question is now how can the passive monitoring find this user’s rogue activity?
More specifically, since any unauthorized wireless hosts will indirectly indicate the presence of the user’s RAWP,
how can we discover those wireless hosts themselves?
What measurable metrics differentiate wireless from wired host traffic properties? And
what algorithms can decide on such metrics in a scalable, real-time fashion with low overhead requirements?