This posting has some good advice for tracking rogue access points:
The issue I have is that many will not work for a huge deployment. I'd like to build a device to look for them that I can keep on me and walk the property, when it detects something it will fire an alert. I can handle the scripting for this, but I am uncertain if my hunch is correct: Does the pineapple spoof AP MAC (BSSID) as well as SSID? If not a default setting, I think I can create a list of all our MAC addresses and compare them to what I see in the facility per our SSIDs.
I found some information on another posting and I want to be clear I'm referring to an Evil Twin, which is a subset of Rogue AP. Yes, a rogue AP is a big deal, but an Evil Twin/Pineapple which is ssl stripping and trying to steal CC's and etc. is a problem. @OscarAkaElvis said this:
"Not exactly. In an Evil Twin, you can "clone" a network but not entirely. I mean, it is supposed you clone "almost all" network characteristics.For example usually is cloned SSID, same channel but the BSSID usually is cloned except one digit. The reason is because an Evil Twin usually is launched at the same time with a DoS to the legitimate network to force users to disconnect. And your fake network can't be exactly the same or the clients of fake network will be kicked too. So the user usually should click voluntarily in the fake network as a consequence of desperation of not having internet"
Which makes sense as if there are 2 BSSID exactly the same you'll tons of issues. This is what I had suspected, but I wouldn't call it confirmed. Can anyone confirm this?
link to other question I took this from: Whats the difference between an evil twin and a rogue access point?