How Do You Find Hidden WiFi AP?

[SamBones]

Ok, to start, I'm not sure what Forum to put this into, but this one seems to be the least wrong.

I recently moved to another state, to a fairly remote rural location. I'm on 3.5 acres, so my nearest neighbor is far enough away that our WiFis don't compete. What I have found is, I have two rogue WiFi access points in my own house that I can't locate.

I have one that says it's "HONEYWELL HOMMED". Googling that it looks like it's a system for reporting health information to a doctor. That makes sense because the previous owners were elderly and it seems like they would have something like that. Unfortunately, I can't find the device putting out that signal!

I have a phone app that I downloaded called "WiFi RADAR". You choose a spot to stand in, then select "Scan". You slowly turn in a circle and it uses signal strength to tell you the direction and distance of an access point. I already knew the signal was strongest in our bedroom, so I did it there. Standing just randomly in the room, it said the AP was 1 meter to my left. I moved a chair and stood one meter to my left and did it again. It said it was zero meters away! I was standing in the middle of the room with nothing around me.

The only thing above me was a ceiling fan. I went into the attic above that bedroom, and only saw insulation and wiring for the ceiling fan and lights that were in the ceiling. NOTHING that looked like it could be a WiFi access point.

So, does anyone know how to track down a WiFi access point with better precision than "WiFi RADAR"?

Part 2 of this problem is that I also have an AP called "NETGEAR28" that I can't locate, but I believe it's part of our ADT security installation.

 

[Scott24x7]

Did you put the security system in after you moved in?
The Honneywell may be embedded in that system otherwise.
Also check your breaker box, and around your breaker box. Watch for rogue wires... APs have to have power from somewhere, so try locating it by looking for newly (as compared to the rest of the house) installed wiring...
Also, check the layout in your breaker box. If power was added specifically for it (possible) then you can kill the breaker, or perhaps trace it down.
Forget apps...


Best Regards,
Scott
MSc ISM, MIET, MASHRAE, CDCAP, CDCP, CDCS, CDCE, CTDC, CTIA, ATS

"I try to be nice, but sometimes my mouth doesn't cooperate.

 

[SamBones]

Thanks for your response.

The security system was in place before we moved in. We took up and started paying their contract. The security company did come out and upgrade the control pads, but everything else was pretty much left in place.

Unfortunately this house is a rats nest of random rogue wires. They used to have satellite TV, then cable, finally a WiMax antenna directly to the provider. All old cables and wires were left in place when new wires were run. I'm coming from a state with very draconian building codes, to one with pretty slack and loose building codes, so I'm seeing stuff that wouldn't be allowed in my old state. I'm getting close to going through the house with a wire cutter and a trash bag, and then build back from there.

The security cameras all seem to have a hard wired line to somewhere for power (attic, closet, etc). I believe they are connected via WiFi since I see a large number of devices connected on my AP. The security company installers (ADT) were unfortunately complete buttholes and didn't answer any technical questions.

The breaker box is very clean (and unlabeled) with nothing obviously added.

I have found an actual Netgear branded router connected to the ADT black boxes in a closet, but it doesn't seem to be plugged in. It is wired to the ADT stuff, but there is no power cord to it, and there are no lights lit. It could be getting power from the ADT box, but I don't want to mess with the ADT stuff too much since we're paying money for it to keep working.

Just FYI in case it helps, the rogue AP's SSID is "HVP_b82ca0dc7b57-Pairing". It's has the following identifiers on the AP, "HONEYWELL HOMMED" and also "Residio".

 

[Rick998]

I'm in the UK so just ignore stuff that is irrelevant.

We tend to use separate mains power circuits (rings) for each housing level (floor) and a seperate (ring) circuit for lighting, often over many floors.

At your mains circuitry box, just turn it all off.

A probe with your cellphone will show you if you have a battery-powered AP.

Next, power up just the lighting circuits to check whether the AP connects.

Next, power up the mains circuits and check again.

From what you have said, I would be looking at disassembling the ceiling fan.

 

[fisheromacs]

It is possible that there is a single access point with multiple ssids.

I would use a utility like WiFiAnalyzer from VREM Software on an Android phone to see all the APs and their associated SSIDs.

I would use a utility on a PC like Advanced IP Scanner to see exactly what is on the networks.

After gathering info I would start trying to access the 'APs'/router via IP in a web browser.

Depending on the router/switch you are using it may be able to tell you a pretty good guess at the length of the cable from a port to the attached device.

 

[SamBones]

My two rogue APs are on different overlapping channels, 4 and 6. The Honeywell HOMMED one is by itself on channel 6, which is why I assumed it was it's own device. All WiFi access points I've used only work on one channel. You can switch channels, but it only operates on one at a time.

My AP is on channel 11, with a 5GHz at 161. The only 5GHz in the house is my stuff.

This coming weekend, I'm planning on trying to power down sections of the house to see if I can at least locate the circuit it's on. Rick998, I'm in the US and we don't have the "rings" you mention, but there are about a dozen different circuits that control areas in the house (i.e. garage, kitchen, master bath and bedroom, living areas, back bedrooms, laundry room, outside lights, etc). Hopefully that will at least let me know where it's getting its power.

And fisheromacs, I don't think I can get to the rogue AP's web app without first connecting to it, and it's password protected.