3

I recently tuned in on my access point to see what data is visible despite encryption.

Am I supposed to find MAC addresses of my non-wifi clients in the 802.11 frames and is this part of the protocol (beacons) or a flaw in my access point? I was able to discover the structure of my full network from the outside like this.

3

It depends on the isolation mode of your WIFI AP.

It is not uncommon for consumer-oriented products to treat their wired and wireless ports as part of the same subnet in order to facilitate device discovery.

1
  • It depends on the isolation mode of your WiFi AP? Client isolation is typically between wireless clients not wired and wireless, especially since resources on the wire (i.e. the gateway device) needs to be accessible to the wireless clients. What is described is standard operation for 802.11 access points, whether they are consumer, small business or enterprise. An AP is simply a L2 bridge between 802.11 and 802.3 traffic. – YLearn May 22 '18 at 19:25
0

Answering your original question and responding to your comments elsewhere...

Am I supposed to find MAC addresses of my non-wifi clients in the 802.11 frames and is this part of the protocol (beacons) or a flaw in my access point?

Unless steps are taken to prevent it, then yes this is how 802.11 works; it is not a flaw. Specifically, your access point is a L2 bridge devices that "translates" between 802.11 frames and 802.3 Ethernet frames.

that is most unfortunate.

Generally speaking, this is actually fortunate for the typical user. This allows both wired and wireless devices to exist on the same L2 domain. This allows a number of services that many user prefer and prevents making the network more complex.

I contacted my vendor and they were interested as well.

I would suggest that whoever you contacted at the vendor is not very knowledgeable about networking. There is nothing at all new or surprising about what you discovered. It is normal operation.

Hopefully I can disable it when they release a new Firmware (they do frequently).

Unlikely. To prevent this, you would need to separate your wired and wireless devices onto to different L2 domains. The most likely way to do this would be to use separate VLANs (which needs to be done at the switch, router DHCP server and possibly elsewhere, not the AP - unless it is some sort of consumer all-in-one gateway device) and this will complicate your typical simple network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.