Wireless Access

Reply
MVP
Posts: 707
Registered: ‎12-01-2010

UNKNOWN-vendor wireless neighbors in the thousands

I have a site which sprouts 10-100 new neighbors each day -- totalling 1230 so far.

A quick check at three other sites andI see just 40 neighbors.

 

Nearly all of the neighbors at this site are from UNKNOWN wireless vendor according to Airwave's RAPIDS, they've each got a unique first three octets, so it's not clear to me where they're comng from. Many are seen by the iAP105 as <-30dB signal so it seems that they're in the building!

 

I was just marking them "suspected neighbor" as I do with all of the personal hotspots which walk into our retail stores every day, but I just realized that the vast majority of the ones I've marked in the last several days are for this one store.

 

Does anyone know of a wireless system which uses a random BSSID header for some obscure reason? Or have any advice on how to narrow down what's probably happening?

 

--Matthew

 

 

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
Guru Elite
Posts: 20,819
Registered: ‎03-29-2007

Re: UNKNOWN-vendor wireless neighbors in the thousands

If they are all the same, what is the mac address? 

 

It is possible it is a new vendor.

 



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

MVP
Posts: 707
Registered: ‎12-01-2010

Re: UNKNOWN-vendor wireless neighbors in the thousands

Not all the same, all different -- no dups in 1400!

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
Guru Elite
Posts: 20,819
Registered: ‎03-29-2007

Re: UNKNOWN-vendor wireless neighbors in the thousands

Are they all the same signal strength?  There are some IDS/IPS systems that use this to cloak their wireless networks:  http://www.networkworld.com/columnists/2007/030507-wireless-security.html

 

 



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

MVP
Posts: 707
Registered: ‎12-01-2010

Re: UNKNOWN-vendor wireless neighbors in the thousands

They vary from -74 to -20

 

Thanks for the link, I'm thinking it's something like that, but the varying signal strength makes me think it's a client-side thing and some carrier's using it on 4G personal hot spots or something.

 

Very annoying.

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
MVP
Posts: 707
Registered: ‎12-01-2010

Re: UNKNOWN-vendor wireless neighbors in the thousands

SOLVED!

 

We finally got permission to take the Aruba access points out of spectrum Monitor mode and put them in Active mode.

The unknowns went away. Well, they stopped accumulating.

We hit over 7900.

 

I suspect there's an issue with the way the access pooints handle discovered devices while in Spectrum Monitor mode which keeps the IDS from analyzing them correctly.

 

I have a ticket on this, and am updating it as well so TAC and eventually the developers will know.

 

--matthew

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
Search Airheads
Showing results for 
Search instead for 
Did you mean: