Rogue Wi-Fi Access Point Triangulation

Rogue AP Position

Path-loss exponent n 2.8

Multipath / fading noise σ 4.0 dB

Rogue AP — X 5.0 m

Rogue AP — Z -6.0 m

Detection

Sampling sensors…

Localization error

—

Confidence

—

Sensors detecting

0 / 5

Avg RSSI

—

WIDS Sensor Readings

How it works

Every real Wireless Intrusion Detection System (WIDS) leans on the same physics: radio power fades with distance in a predictable way, so several fixed sensor radios can jointly locate an unauthorized transmitter without ever touching it. This is the same defensive technique enterprise WIDS/WIPS appliances (Cisco, Aruba, Cisco Meraki) use to flag and physically locate a rogue or "evil-twin" access point planted inside a building.

1. Log-distance path-loss model. Received signal strength falls off logarithmically with distance:

RSSI(d) = RSSI0 - 10·n·log10(d / d0)

RSSI0 = reference power at d0 = 1 m  (here -40 dBm)
n     = path-loss exponent (≈2 in open air, 2.7-3.5 indoors with walls)

Each sensor's measured value adds Gaussian multipath/fading noise (the σ slider), then inverting the formula gives that sensor's estimated distance to the transmitter.

2. Multilateration (least squares). With distance estimates d1..dn from n≥3 sensors at known positions, subtracting one sensor's equation from every other linearizes the circle equations into:

2(xi-xr)x + 2(zi-zr)z =
   (xi²-xr²)+(zi²-zr²) - (di²-dr²)

which is solved for the intruder's (x, z) via the normal equations A^TA·p = A^Tb. A sensor below the receive-sensitivity floor (−85 dBm) is excluded — below three participating sensors there is no unique fix and the system reports "insufficient sensors".

n — raises or lowers how fast signal decays with distance (denser buildings → higher n → shorter effective range).
σ — multipath/fading noise added to each sensor's reading; higher σ widens the gap between the true and estimated marker.
X / Z — moves the rogue transmitter through the monitored floor plan; watch sensors drop out of range near the edges.

Real WIDS deployments feed this estimate straight into a WIPS containment action — targeted deauthentication frames or a security-team dispatch to the physical location — which is why the accuracy of the underlying trilateration matters operationally, not just academically.

WIDS sensor Legitimate AP Rogue AP (true position) Estimated position

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.