How to find a potential hacker

[stevecullen]

Anyone know of any tools to track down the PC of a potential hacker? I've got things buttoned up pretty tight so I'm not concerned, but once in a while I'll get a syslog warning that an unauthorized user is trying to authenticate. Sure would be nice to have a portable spectrum analyzer to home in on the signal, but I'm guessing that there's a cheaper alternative.

[p.krane]

IDS (www.cisco.com/go/ids) could assist in alerting you to the attempt but tracking down the hacker will be a much greater task, especially if their spoofing their source.

[blue.modal]

If you know which AP, that's a good start. But if it ruly is a hacker, not even a nice fat honey pot will keep them there when they see you sweeping the area with a directional antenna!

It could be one of your own machines mis-configured, or an employee trying to use their own machine or card or handheld.