I logged in to a public WiFi network (Provided by one one of the leading ISPs @ Oz) and tried to run a nmap and do a network discovery(Not to do any harmful activity but just because of curiosity).

But the results shows only my IP and the Gateway IP. How this security measure is implemented ? How they hide others from me ?

  • 1
    If the gateway is also the network switch (i.e. typical for WiFi AP) this can be done with some simple packet filtering which allows only traffic between a host and the gateway but not between different hosts on the local network. – Steffen Ullrich Jan 7 '17 at 10:56
  • Features used to implement this include Private VLANs and Client Isolation. The way it works depends on the vendor of the Wi-Fi equipment. – Sander Steffann Jan 7 '17 at 12:02


[Client isolation] confines and restricts clients connected to the Wi-Fi network. They can’t interact with devices connected to the more secure wired network, nor can they communicate with each other. They can only access the Internet.

Indeed, this is either AP isolation, or an IPS-like function in the router. My cheap Sitecom router has a function labeled 'Block NMap scan' and it does about the same thing, depending on what scanmode i use.

However this is not done by the ISP :)

With NMap, if you're scanning the devices there, seeing just the gateway, you interrogate the LAN (local area). The ISP will usually not have a clou this is happening. If you were scanning external devices, say, a website, this would go over WAN (wide area), this is something the ISP could see and possibly influence.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.