I have a large scale wireless network secured using WPA/WPA2 Enterprise authentication. Recently, I was made aware of the possibility that someone may use a dd-wrt router and a computer to spoof the wireless network and grab usernames and passwords as devices attempt to connect to it.
To test this theory, I succeeded in spoofing the SSID and authentication method. I set up a local RADIUS sever and could see my device (which remembered my credentials) trying to connect to it. However, I did not see my password anywhere in the RADIUS server logs (but then again, logs might not contain such information, even in debugging mode), or using Wireshark placed between the Wireless AP and the RADIUS server.
Is there any way to capture my password from a connection attempt, or does that require information only the actual RADIUS server will have? (My device has authenticated with the actual network before)
And are there any steps I (not the network admin) can take on my clients that will ensure they do not attempt to connect to similar rogue APs?