Abstract: Detecting access point MAC spoofing in a wireless digital network. A sensor in a wireless digital network learns the MAC address and operating channel for at least one access point. If the sensor detects frames being sent to a MAC address on a channel other than the channel associated with that MAC address, then the access point associated with the MAC address is being spoofed. These frames may be association frames, or data frames. If the sensor is running as part of an access point the sensor also knows what clients are associated with the access point. If the sensor detects frames indicating association, such as data frames, sent to its MAC address, but the client is not associated with the access point, then the access point is being spoofed. Similarly, if the sensor receives frames on a channel other than that associated with the access point and receives traffic for the access point's MAC address, the access point is being spoofed.

Abstract: Detecting spoofing in a digital network. Packets of information in a digital network using a shared medium contain a unique identifier for the device originating the packet. An individual device may be transmitting, or receiving, but not both. If a device receives a packet containing its unique identifier as the origin address, that packet must have been transmitted by another device, and a spoofing alert is raised.