Wireless Access

I have a site which sprouts 10-100 new neighbors each day -- totalling 1230 so far.

A quick check at three other sites andI see just 40 neighbors.

Nearly all of the neighbors at this site are from UNKNOWN wireless vendor according to Airwave's RAPIDS, they've each got a unique first three octets, so it's not clear to me where they're comng from. Many are seen by the iAP105 as <-30dB signal so it seems that they're in the building!

I was just marking them "suspected neighbor" as I do with all of the personal hotspots which walk into our retail stores every day, but I just realized that the vast majority of the ones I've marked in the last several days are for this one store.

Does anyone know of a wireless system which uses a random BSSID header for some obscure reason? Or have any advice on how to narrow down what's probably happening?

--Matthew

If they are all the same, what is the mac address? 

It is possible it is a new vendor.

Not all the same, all different -- no dups in 1400!

Are they all the same signal strength?  There are some IDS/IPS systems that use this to cloak their wireless networks:  http://www.networkworld.com/columnists/2007/030507-wireless-security.html

They vary from -74 to -20

Thanks for the link, I'm thinking it's something like that, but the varying signal strength makes me think it's a client-side thing and some carrier's using it on 4G personal hot spots or something.

Very annoying.

SOLVED!

We finally got permission to take the Aruba access points out of spectrum Monitor mode and put them in Active mode.

The unknowns went away. Well, they stopped accumulating.

We hit over 7900.

I suspect there's an issue with the way the access pooints handle discovered devices while in Spectrum Monitor mode which keeps the IDS from analyzing them correctly.

I have a ticket on this, and am updating it as well so TAC and eventually the developers will know.

--matthew