conundrum

Jeff Liebermann <(E-Mail Removed)> wrote:
> On Wed, 28 Sep 2005 09:43:51 -0300, Derek Broughton
> <(E-Mail Removed)> wrote:

>>> Now I'm puzzled. I thought SSID b/cast was basically for the benefit of
>>> site-survey needs:
>>> in other words, if you know the SSID, you don't need
>>> it broadcast in order to find the network. I've not seen it mentioned
>>> elsewhere that it is needed for normal operations.

> Nope. Some really dumb clients can't connect unless they hear the
> SSID broadcasts. I bought a no-name PCMCIA card that did that. Even
> if you knew the SSID of the access point, it still refused to connect.
> However, I think this is the exception rather than the rule and really
> should not be a problem with today's clients.

>>It's not. If Jeff's guess is right (and they usually are)

> I've been wrong before. Caveat Emptor.

>>this seems like a
>>pretty good reason, to me, to NOT broadcast the SSID.

> In my never humble opinion, hiding the SSID is dumb. It screws up a
> few clients and make interference detection complicated. For what
> little security it adds, it sure makes life difficult for all
> involved. It's like hiding your house address from the post office.
> Normally, the mail will arrive, but it sure makes it difficult for
> everyone else.

>>Now you have an easy
>>way to see if somebody's extending your signal. What you'd do about it is
>>up to you...

> It's not too difficult to sniff the traffic and see if there's a
> repeater around. You'll see all the packets twice. Once going in,
> and once going out. The real problem is that some repeaters (I forgot
> which ones) can be set to ANY for the SSID and will regurgitate all
> packets, regardless of SSID. I think this feature was invented so
> that a single repeater can service multiple networks. Nice idea but
> there are complications when it starts regurgitating unwanted packets.

> In about 1999, I intentionally installed one of those at a high point
> overlooking the downtown area. You could connect to just about any of
> the dozen assorted networks. Everyone's range was magically extended
> over the entire town. I thought this was cool.

> Unfortunately, all the local wireless networks were also having
> trouble with what appeared to be co-channel interference. Traffic was
> slothish, erratic, and prone to disconnects. Turn off the repeater
> and everything was back to normal. Hmmm... Well, when the repeater
> literally doubles the amount of traffic in the air, adds everyone
> else's traffic to the mess, and guarantees that everyone will have to
> wait until the repeater is done sending, then we have interference.
> The repeater lasted about 3 days and went back to playing access
> point.

> I'm still not sure it's a repeater that was causing the SSID to
> appear, but I can't think of much else that could do it, other than a
> spoofed access point or hacker.

There is one more thing,was the ssid of the non-broadcasting AP in
the clients active profile used in the the site survey?
it could cause it to appear in that clients survey but not another
configured for a different ssid..