0

In an effort to better secure my Wi-Fi network by finding its weaknesses and mitigating them, I have employed the use of Kismet, a well known Wi-Fi security scanning tool. When I use Kismet to scan for Wi-Fi devices I would expect to see only wireless devices showing up, however, I notice that my WIRED devices also show up because my Wi-Fi AP is connected to the rest of my network. My goal is to mask my WIRED devices from all Wi-Fi scanning efforts for extra security and privacy.

I would like to explore the various options that are available starting with any that do not include additional hardware purchases. One item I am contemplating is setting up a VLAN on my Managed switch. I'm also curious if there are any general AP settings that apply to most AP's that could be tweaked or if the problem could be related to my AP not supporting certain security standards without divulging the make and model of the AP. I will divulge that the AP is a combo AP / Router unit and that it is in AP Only Mode just in case that helps. (For example, if the leaking of the MAC addresses is due to the fact that the AP is a combo unit, replacing it with a dedicated AP only unit might be an option I would consider).

enter image description here

There is a location on the Kismet website that mentions the Source and Destination packets origination MAC address is picked up by Kismet but it doesn't go into detail about what can be done to keep your wired devices from showing up on Kismet.

I'm curious if I can use a VLAN or a setting on my Wi-Fi AP to prevent the wired devices from being detected with Kismet (or some other secure method). The wired devices show up as Wi-Fi Bridged in Kismet. The first time I noticed this I almost fell down onto the ground. The way I understand it is that the only MAC addresses that any wardriver should see when scanning my Wi-Fi network would be the 2 phones and my Wi-Fi Access Point. Instead, they would see every MAC address on my whole network. A high tech thief or a wardriver could exploit this vulnerability because they would see dozens and dozens of MAC addresses instead of just a few. Most MAC addresses list the vendor names.

This is a huge security risk I am hoping to mitigate. Hoping someone has the answer. For anyone who is not familiar with Kismet, or does not understand why you don't want your wired devices to show up on a Wi-Fi scan, please read the following article. It is very informative.

Kismet - Watch Wi-Fi User Activity Through Walls

enter image description here

closed as off-topic by Ron Maupin Apr 13 at 1:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

0

Your WAP, like your switches, is a bridge and part of the broadcast domain. Bridges flood broadcasts, unknown unicasts, and multicasts (unless you have IGMP snooping, but even then, there are still multicasts that get flooded) to all the bridge interfaces.

A VLAN is a broadcast domain. For traffic to get from one VLAN to another VLAN, it must be forwarded by a router. Routers route packets between networks, so they will not normally forward the broadcasts, unknown unicasts, and multicasts. You can also impose security features on the router to restrict traffic that can be sent between the networks.

The problem with your topology is the unmanaged switch. You cannot use VLANs because of the unmanaged switch will only have a single VLAN. You would need a managed switch with a trunk to the router, and configure the router interface with subinterfaces (one for each VLAN). It may be possible for you to reverse the unmanaged and managed switches to accomplish the separate VLANs.

Unfortunately, you did not give the device models and configurations, so we cannot give you more detailed instruction on how to configure the devices.

  • Is it common for WAP's to broadcast MAC addresses in this manner? I notice that quite a few WAP's around me all do the same thing, but not all of them. – Crazy Buckaroo Apr 13 at 0:30
  • Yes, a WAP is a bridge, and that is how bridges work. For example, if a host on the wired network needs to communicate with a host on the wireless network, it will use ARP (a broadcast) to get the MAC address of the wireless host, so the WAP must broadcast that. The same thing happens if a host on the wired network needs to send an ARP request for a host on the wired network. The switches will broadcast the ARP request to all interfaces, including that of the WAP, and the WAP must broadcast the ARP request because it is sent to the broadcast MAC address. – Ron Maupin Apr 13 at 0:35
  • So, would it be possible to mitigate this issue just by replacing the WAP with a new WAP that has the capability to turn off or filter the ARP requests, or, wouldn't a new WAP alone be able to handle this mitigation? – Crazy Buckaroo Apr 13 at 0:54
  • No, you would break the network if you turn off ARP. Broadcasts are an essential part of ethernet and Wi-Fi, and flooding is necessary, too. – Ron Maupin Apr 13 at 0:57
  • Do most people worry about MAC addresses being seen in this manner or am I being extra paranoid for not wanting my wired MAC addresses to be seen by any wardriver or neighbor who happens to be scanning with Kismet? I was shocked the first time I saw the results of a Kismet scan because I expected all WiFi radio devices to show up only. I never expected to see all the wired devices. – Crazy Buckaroo Apr 13 at 1:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.