How do I find hidden remote-access routers in our production network?
Look at the cabinets and the network together. Physically: open machine cabinets during the next planned stop and look for small routers, modems and antennas, and ask each supplier for a list of the communication devices in their equipment. On the network: look for devices that behave like gateways, for example a machine whose traffic goes to an address that is not your router, a device that hands out its own addresses, or a host that receives connections from outside at times when nobody on your side started them. A device that appears on your network map but on no drawing deserves a question. The NetSenX network map, on every plan, lists the devices it sees talking on monitored segments with first and last seen, and beaconing is flagged for devices that call out at regular intervals. A router that talks only over its cellular link and stays quiet on your LAN cannot be found from the network; the cabinet inspection finds it.