In an effort to better secure my Wi-Fi network by finding its weaknesses and mitigating them, I have employed the use of Kismet, a well known Wi-Fi security scanning tool. When I use Kismet to scan for Wi-Fi devices I would expect to see only wireless devices showing up, however, I notice that my WIRED devices also show up because my Wi-Fi AP is connected to the rest of my network. My goal is to mask my WIRED devices from all Wi-Fi scanning efforts for extra security and privacy.
I would like to explore the various options that are available starting with any that do not include additional hardware purchases. One item I am contemplating is setting up a VLAN on my Managed switch. I'm also curious if there are any general AP settings that apply to most AP's that could be tweaked or if the problem could be related to my AP not supporting certain security standards without divulging the make and model of the AP. I will divulge that the AP is a combo AP / Router unit and that it is in AP Only Mode just in case that helps. (For example, if the leaking of the MAC addresses is due to the fact that the AP is a combo unit, replacing it with a dedicated AP only unit might be an option I would consider).
There is a location on the Kismet website that mentions the Source and Destination packets origination MAC address is picked up by Kismet but it doesn't go into detail about what can be done to keep your wired devices from showing up on Kismet.
I'm curious if I can use a VLAN or a setting on my Wi-Fi AP to prevent the wired devices from being detected with Kismet (or some other secure method). The wired devices show up as Wi-Fi Bridged in Kismet. The first time I noticed this I almost fell down onto the ground. The way I understand it is that the only MAC addresses that any wardriver should see when scanning my Wi-Fi network would be the 2 phones and my Wi-Fi Access Point. Instead, they would see every MAC address on my whole network. A high tech thief or a wardriver could exploit this vulnerability because they would see dozens and dozens of MAC addresses instead of just a few. Most MAC addresses list the vendor names.
This is a huge security risk I am hoping to mitigate. Hoping someone has the answer. For anyone who is not familiar with Kismet, or does not understand why you don't want your wired devices to show up on a Wi-Fi scan, please read the following article. It is very informative.