I have a rookie question regarding routing and wifi access points.
I have a main switch (cisco catalyst 2950) that sits behind my router/firewall. On that switch I have an IDS (snort) listening on a span port, which is mirroring all traffic entering and exiting the network. I also have a Linksys WRT54G wifi router proving wireless service whose "internet" port is also plugged into the switch.
The network is segmented into two subnets, x.x.1.1/24 for the wired portion of the network, and x.x.2.1/24 provided by the linksys ap for the wireless.
My issue is that when reviewing alerts from snort, any traffic from the x.x.1.1 network can be attributed to the actual machine behind my network, but traffic coming from a machine on my wifi router has a source (or destination) ip of the AP itself.
Now, I understand that this is because the wifi router is a router and as such, is acting exactly how it is designed to.
I need to provide wireless access, yet provide the IDS insight into the actual source/destination machines on the wireless network. But I'm not sure if it's possible. Is there a feature/technology/mode that can be found on wifi routers that will let me extend the x.x.1.1 network? Do I need to replace the wifi router with some other piece of wifi equipment?
I've looked at the following options:
Spanning a port of the wifi router to monitor traffic on the x.x.2.1/24 network. My current wifi router doesn't provide span/mirroring capability and doesn't appear to support modified firmware images.
Putting the wifi router in some "mode" that allows it to not "route" traffic. My hardware currently has a gateway mode and a router mode. Both modes appear to cause the same issue. Is there another "mode" that may be available on other consumer level wifi access points?
Purchasing a piece of hardware that does not route traffic but provides wireless access? Does this even exist?
I understand that this is a complex question with imperfect information. A complete answer would be fantastic, but something that gets me on the right track would be more than enough. Thanks for reading to the end!