Abstract: An apparatus, a method, and logic encoded in computer readable media that when executed operable to carry out the method. The method includes wirelessly receiving at a receiving station a signal transmitted from a transmitting station in a wireless network. The signal includes a network identifier, e.g., MAC address of the transmitting station. The method includes determining one or more RF waveform characteristics of at least a transient part of the received signal, decoding the received signal to determine the network identifier, e.g., MAC address, determining one or more behavior characteristics from the received signal; and using the decoded network identifier, e.g., MAC address and a combination of the one or more waveform characteristics and the one or more behavior characteristics to ascertain whether or not the network identifier, e.g., MAC address is a spoofed identifier, the ascertaining using historical samples of combinations for different network identifiers.