201 response engine 606 may be for example a computer script written in the common list processing lisp language that is especially suited for rule based invocation of responses or an executed computer application program written in another appropriate programming language the responses may include for example communicating with switch 102 through a network management interface to disable e g shutting off the port connected to an identified unauthorized ap or to filter traffic to and from a detected unauthorized wireless ap on the port connected thereto the response may also include sending an alert to the person responsible for network security of the location upon receiving an alert the person responsible for network security may for example verify the incident record the location of the detected authorized ap and shut down the switch port connected thereto pre processors 601 and 603 pattern matching engine 604 and response engine 606 may also be embodied as dedicated hardware such as computers devices with embedded software for example fpga devices and programmable logic devices or even application specific integrated circuits asics the current invention may monitor network traffic passively without injecting discovery or market packets into the network thus there is no disruption to normal network operations and no advance warning that an unauthorized user may detect in order to take evasive counter measures for example by shutting.