Find a rogue AP's switch port

When you need this

• “The controller says there’s a rogue AP on the wire. Where is it?”
• “Someone plugged a personal access point into a jack. Which one?”
• “Security wants the physical location of every unauthorized AP on the network.”

A wireless controller is always listening over the air, and it flags APs it doesn’t manage as rogues — classifying each and, crucially, deciding whether it’s on the wire (physically plugged into your network). The controller knows the rogue’s MAC but not where it’s connected. l2trace already has every switch’s CAM table, so it looks the rogue MAC up there and hands you the exact switch and port.

In the browser

Open Rogues. Two sections:

• On the wire · go unplug it — rogues whose MAC l2trace found in a switch CAM. That’s direct evidence the rogue is physically patched into the fabric, and it’s a stronger signal than the controller’s own on-wire flag: the controller relies on RLDP, which is often disabled or misses wired rogues (on a production 9800, the controller flagged zero as on-wire, yet the CAM found one plugged in). Each row shows the classification, SSID, and the switch + port + VLAN it’s hiding on. This is the actionable list; the controller’s own on-wire flag is shown as corroboration, not the gate.
• Detected over the air — everything else: rogues heard over the air that aren’t on your network (a neighbor’s AP), or whose MAC isn’t in any CAM yet. Informational, not actionable here.

The correlation prefers an access port over a trunk — a rogue MAC seen on a trunk is just the flooded path toward where it’s plugged in, while an access hit is the actual jack.

From the API (for automation / SIEM)

curl -s "https://l2trace.example.net/api/rogue-aps?on_wire_only=true"

Each element:

{
  "mac", "wlc", "classification",           // malicious | friendly | unclassified | custom | unknown
  "on_wire", "ssid", "channel", "rssi", "detecting_ap_mac", "since",
  "located_switch", "located_port", "located_vlan", "located"
}

The go-unplug-it feed is on_wire_only=true filtered to located: true:

curl -s ".../api/rogue-aps?on_wire_only=true" | jq '.[] | select(.located)'

Which controllers

• Catalyst 9800 (IOS-XE) — pulled over RESTCONF automatically alongside the existing wireless client collection; no extra config. Opt out per controller with extras.rogue_detection = false on the device_collector row.
• AireOS (5508/8540/vWLC) — via the AIRESPACE-WIRELESS-MIB over SNMP (the same rogue table AireOS exposes), for controllers that don’t speak the IOS-XE API.

Reading it honestly

located: false doesn’t mean “safe” — it means the rogue’s MAC isn’t in any CAM l2trace has collected. That’s expected for a purely over-the-air rogue (a neighbor’s AP), but it can also happen if the rogue is on a switch l2trace doesn’t poll, or if it advertises a BSSID that differs from its wired MAC. The controller’s own on_wire flag is the primary “is it plugged in” signal; l2trace’s job is to turn that into a port when it can.