of the present invention an unauthenticated device may be marked as guest upon discovery by the network monitoring device in the event that the monitoring device detects a successful login a record in a device status data table associated with the unauthenticated device may be updated to indicate that the device is a non guest device if the monitoring device detects one or more failed login attempts a record in a device status data table may either be left unchanged or may be changed to indicate that the unauthenticated device is a rogue device according to some embodiments of the present invention the monitoring device may be connected to the network inline in which case the device is in the data path between the clients and the servers and actively forwards network traffic according to other embodiments of the present invention the monitoring device may be connected not inline in which case the device passively monitors network traffic that may be replicated to it by the communication equipment or by other means according to some embodiments of the present invention the authentication server may be a server using a network protocol which allows or requires user authentication such as but not limited to an http web server a telnet server a netbios server an ftp server an ms exchange server mapi or a pop3.