be queried. This approach assumes that the wireless router
responds to httpd queries. Additionally, this invasive
approach is considered active, adding significant unwanted
traffic on the network and can also alert an advanced rogue
AP user of a scan for the AP. The suite also has an
application which allows the viewing of html code generated
when configuring AP settings. Though this approach will
work in theory, the window of opportunity is limited since
this data is only transmitted when the AP’s configuration is
updated. Additionally, as signature-based IDSs can attest,
reassembling application-level data becomes more difficult
and impractical as network speeds increase.
Another LAN only approach is presented by Wimetrics [4].
Their product has a LAN only approach, but is ambiguous
with details. The basic premise of their work is that they
probe the network to identify the profile of a wireless AP.
While the details were unclear, Wimetrics’ general approach
proves not scalable since it requires a PC to sit on each
segment of the network. Their approach unjustly assumes that
the network is a shared network. As discussed in the
previous section, APs can be configured to ignore network
queries.