A trick which sometimes helps is to put the machine in a quarantine vlan with a browser-popup message (e.g. about a virus infection / malware) to get the user report himself to the helpdesk (who are in the plot on this one ; they know it is about a stolen device).....
best regards, Kees >>> Mark Duling 14-03-13 16:48 >>> Oops. I haven't had coffee yet. You wanted to know the location on a wireless net after you know it's back. Nedi can't do that on a controller based network. On Thu, Mar 14, 2013 at 8:44 AM, Mark Duling wrote: > Nedi has a function so assist with finding stolen laptops. I've never > actually used it, but it is great at discovery and node lookups on mac > address and other criteria. > > http://www.nedi.ch/ > > > On Thu, Mar 14, 2013 at 5:22 AM, Alexandra Frincu < > [email protected]> wrote: > >> Hello, **** >> >> ** ** >> >> In a wireless campus network, it happens that stolen devices reappear. ** >> ** >> >> This subject has been already addressed on Educause in 2008:**** >> >> ** ** >> >> >> http://listserv.educause.edu/cgi-bin/wa.exe?A2=ind0812&L=WIRELESS-LAN&T=0&F=&S=&P=37407 >> **** >> >> ** ** >> >> and in 2010:**** >> >> ** ** >> >> http://seclists.org/educause/2010/q3/176**** >> >> ** ** >> >> I am wondering if progress was made on this topic in the last years.**** >> >> ** ** >> >> In particular, I wonder how to precisely locate a stolen device, after >> you get the alert that its MAC address is detected on the network (the >> laptop appears associated to a specific AP in a specific building).**** >> >> How can you pinpoint that device?**** >> >> ** ** >> >> One option, is to walk around with a laptop and an AirPcap card, sniffing >> the traffic, filtering on that certain MAC address and when the RSSI gets >> higher it means you are closer to that stolen laptop. **** >> >> However, this is not that discreet and there’s always the risk that >> before being able to pinpoint the laptop, the fake owner will leave.**** >> >> ** ** >> >> Another option is to use tcpdump on a laptop, and filter the raw packets >> from that MAC address and constantly monitoring its signal level until the >> best value is found. Airodump, which shows the traffic on all channels is >> also an alternative.**** >> >> ** ** >> >> Is there a complex and more user friendly tool that is being used in your >> campus? ideally, a tool simple enough so it could be used by the security >> staff (the persons entitled to catch the thief) on a tablet or smartphone? >> **** >> >> ** ** >> >> Any experience/thought/recommendation on this subject would be highly >> appreciated.**** >> >> ** ** >> >> Best regards, **** >> >> ** ** >> >> Alex**** >> ********** Participation and subscription information for this EDUCAUSE >> Constituent Group discussion list can be found at >> http://www.educause.edu/groups/. >> >> > ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. --------------------------------------------------------------------------- Op deze e-mail zijn de volgende voorwaarden van toepassing: The following conditions apply to this e-mail: http://emaildisclaimer.avans.nl --------------------------------------------------------------------------- ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
