I'm testing, for studying purpose, an evil twin attack. In my scenario I have both the rogue AP made by my laptop and the real AP with the same SSID and MAC address, but with different security protocols (the rogue one is open, while the real one has WPA2) and optionally different channels.
Now, with both APs working on the same channel, it seems that different systems have different capabilities of recognizing both of them, or only one. I have 3 systems:
-on Windows and Android I can see and connect to both
-on Linux Slackware, networkmanager can only see the real one, and even if that is shut down, it starts seeing the rogue one, but can't connect to it
How is this possible? What parameters are used to know that there are two different networks, and not only one with two APs?