Rogue Access Points: How to Detect Unauthorised Wireless Devices in Your Warehouse

TL;DR

• A rogue access point is a wireless device connected to your network without your approval.
• On a warehouse site, a rogue is usually unmanaged equipment, like a conveyor vendor’s support router or a printer with Wi-Fi Direct left on, rather than an attacker.
• Detection pairs a radio scan with a check of the wired network, because a device you can hear only matters if it’s plugged into your switches.
• A network you can hear that isn’t connected to yours is a neighbour, and treating neighbours as rogues is how scan reports end up ignored.
• For sites in scope, PCI DSS v4.0.1 Requirement 11.2.1 asks you to detect and identify authorised and unauthorised wireless access points at least once every three months.

Run a wireless scan in a distribution centre and you’ll often find networks nobody in IT set up. The source may be a remote-support router installed by a conveyor vendor, a mobile printer using Wi-Fi Direct, or a telematics gateway on a forklift. An attacker in the car park is possible, but it’s not always the most likely explanation.

That still creates a security risk. A rogue access point connected to your network creates an unmanaged entry point that may not be monitored. This guide covers what rogue devices look like on a warehouse floor, how they’re detected, what to do when you find one, and what PCI DSS requires if your site is in scope.

 

What is a rogue access point?

A rogue access point (rogue AP) is a wireless access point connected to your network without approval. It may be malicious, but it can also be a device someone installed to solve a practical problem.

Three things are often confused:

Rogue AP: Connected to your network without authorisation.

Neighbouring network: A separate network you can detect nearby, but that isn’t connected to yours.

Evil twin: A fake access point that copies your network name to trick devices into connecting. It doesn’t need access to your wired network.

Enterprise authentication such as 802.1X can make evil twins harder to use against managed devices because devices authenticate to the network and verify its certificate before connecting.

 

What rogue devices look like in a warehouse

Most guides picture an employee’s router under a desk. On a warehouse floor, the likely sources are often third-party equipment, temporary devices or networks from neighbouring sites.

Here’s a register you can adapt for your own site.

Device	How it usually shows up	How to classify it	What to do
3PL client’s or tenant’s access point	Broadcasts its own SSID and may be connected to a shared switch	Authorised if agreed and documented; rogue if connected without approval	Agree a separate VLAN or internet service and record it in the inventory
Conveyor, sortation or automation vendor’s remote-support router	Connected to a switch port, often with its own 4G link and Wi-Fi	Rogue until approved	Replace with an approved remote-access method, or isolate and document it
Forklift or telematics gateway	Broadcasts an SSID from the vehicle or charging area, and may connect to your Wi-Fi	Depends on whether it connects to your network	Confirm with the fleet provider and place it on its own segment
Wi-Fi security camera	Has its own SSID or connects through a consumer router	Rogue if it introduces an unapproved router to your network	Move it to a managed camera network
Label printer with Wi-Fi Direct enabled	Broadcasts a DIRECT- style SSID	Usually not connected to your wired network, but still creates a separate wireless access point	Disable Wi-Fi Direct if it isn’t required
Staff phone hotspot	Personal SSID that appears and disappears with shifts	Usually a neighbouring network unless a laptop bridges it to the wired network	Set a policy and monitor for wired-to-wireless bridging
Consumer router used to fix a dead spot	Connected to a wall port with its own SSID	Rogue	Remove it and fix the coverage properly
Neighbouring warehouse network	Steady SSIDs at weak signal along a shared wall	Neighbour	Record it as a known neighbour so it doesn’t trigger repeated alerts

 

The printer row applies to kit Gamma supplies. A Zebra or Honeywell mobile printer shipped with Wi-Fi Direct on will broadcast its own network until someone turns it off. Staff hotspots also add to interference on a busy floor. 

RF interference in warehouse Wi-Fi →

Two rows cause most of the trouble. The vendor’s remote-support router often bridges your corporate network straight to the internet, around your firewall, so the vendor can dial in without raising a ticket. It was probably installed with good intentions during commissioning and then forgotten.

Neighbours create a different problem. A multi-tenant logistics estate can have many unrelated networks within range. Treating every unfamiliar SSID as a threat creates repeated alerts and makes genuine rogue devices harder to spot. Record known neighbouring networks so they can be excluded from routine alerts. 

 

How rogue wireless device detection works

Detection has two parts. On the radio side, access points or sensors record nearby devices, including their MAC address, SSID, channel and signal strength. This shows what’s on the air, but not whether a device is connected to your network.

The wired side compares these findings with switch address tables. This helps distinguish a rogue device from a neighbouring network, which a basic Wi-Fi scanner can’t reliably do.

Detection can use handheld tools, access points scanning other channels, or dedicated sensors that monitor continuously. WIDS raises alerts, while WIPS can also take action against detected threats.

The key takeaway: an unknown SSID isn’t automatically a rogue AP. You need to confirm whether it connects to your network before deciding what to do.

Gamma’s wireless site survey includes rogue access point detection and checks for signal leakage beyond the building.

 

Rogue device detection software, including what you may already own

Many enterprise wireless systems already include rogue AP detection, so check your existing platform before buying a separate tool.

Cisco controllers support rogue AP detection, including the Embedded Wireless Controller on Catalyst 9100 access points. Meraki access points include Air Marshal, which can detect rogue and other nearby access points.

Aruba AirWave RAPIDS is specifically designed for rogue AP detection. It can combine wireless and wired information to help classify devices and, where a rogue is detected on the wire, identify its switch and port.  

On Cisco sites, controllers in the same mobility group share their AP lists so they don’t flag each other’s access points as rogue.

 

Classification is the hard part

Rogue device detection isn’t about flagging every unfamiliar network. It’s about identifying what’s connected to your network, confirming what belongs there, and dealing with anything that doesn’t.

Regular scans, an up-to-date device register and clear rules for third-party equipment can keep the list manageable. If you need help assessing your warehouse’s wireless environment, Gamma’s wireless site survey service can identify rogue access points, check for signal leakage and provide a report of its findings.

 

Frequently asked questions

What is a rogue access point?

A wireless access point connected to your network without approval. On a warehouse site, it may be unmanaged equipment brought in by a vendor, tenant or staff member rather than an attacker.

What is the difference between a rogue access point and an evil twin?

A rogue AP is an unauthorised access point connected to your network. An evil twin impersonates a legitimate Wi-Fi network to trick devices into connecting to it and doesn’t need to connect to your network.

How do I know if a Wi-Fi network I can see is a rogue or just a neighbour?

Check whether it’s connected to your wired network. Enterprise detection tools can correlate wireless findings with wired network data. If there’s no connection to your network, it may be a neighbouring network.

How do you detect rogue wireless devices?

Scan for nearby wireless devices using access points, sensors or a handheld tool, then correlate the results with your wired network to identify devices connected to it.

Can my existing access points detect rogue devices?

Many enterprise wireless systems can. Cisco controllers, Cisco Meraki Air Marshal and Aruba AirWave RAPIDS support rogue AP detection. Check your existing platform before buying a separate tool.

How often do I need to scan for rogue access points under PCI DSS?

PCI DSS Requirement 11.2.1 requires wireless access points to be tested, detected and identified at least once every three months. If automated monitoring is used, it must generate alerts for personnel. 

Does PCI DSS wireless scanning apply to my warehouse?

It depends on whether your warehouse or its systems are within PCI DSS scope. If warehouse systems or networks are part of, or can affect the security of, the cardholder data environment, PCI DSS requirements may apply. Your organisation’s PCI DSS scoping assessment determines which requirements apply. 

What should I do if I find a rogue access point?

Locate it, identify who owns it, then decide whether to approve and document it, disable it, or remove it. Don’t attempt to disrupt wireless networks you don’t own.