There is a street and respectively a railway track between our buildings and the other two.

I thought maybe the users of the other APs are connected to our LAN via VPN but that is also not the case.

If you are absolutely sure there is no physical connection or wireless bridging taking place, I would call TAC.

Keep in mind that the way that the controller detects if a rogue AP is on the network is that it pings its own IP address. It may be that, by coincidence, there is a device with the same IP address as the controller on the neighboring network.

I do not believe that the controller is able to tell if it sent the response to this ping or not.

Hope this helps,

- John

(Please remember to rate helpful posts)

Scott raises an interesting point.

It is possible for Windows-based laptops to permit their wireless connection to be shared with other users. This can result in a layer 2 bridging by the laptop itself between your wired and wireless networks. This is often the result of a misconfigured NIC on the access point. If you can narrow down which machine has this MAC, it could get you a lot farther.

Alternately, if you are hunting an adhoc rogue, in theory, if you could connect to it with a wireless laptop you could perform a network discovery to see what is out there.

Of course, you will want to consider any legal ramifications prior to attempting to do this if it turns out that this rogue equipment is not on your network.

- John

(Please remember to rate helpful posts)