The risks using open public WiFi networks has been done to death.

What I've been wondering is whether an open WiFi network (typically public) is safe against packet-sniffing if that network is using client isolation?

(Putting aside the still-important risk of an evil twin which the above does not mitigate against)

As I understand it, using client isolation means just that. If a bad actor connects to the same open network, they, and myself for that matter, are limited to our own broadcast domain. Which effectively means, they can't see my traffic. Period.

Assuming the answer is yes (client isolation prevents packet-sniffing), to what degree does client isolation make using an open network safer to use?

Follow-up to above, is there a good tool to test if this has been implemented on a said open network? My idea would be to connect another device to that same network and unleash some nmap goodness to validate.

  • 3
    Interfaces in monitor mode do not need to be associated with an access point to see wireless traffic. – user Aug 22 '19 at 17:49

TR,DR: Not true.

Imagine an Ethernet network using VLAN tagging, and client isolation. Each client can only talk to the gateway, and not to themselves in any way. But clients are not connected via a switch, but by a common hub. If any client stars a packet sniffer, it can see every packet, as the hub broadcasts every packet to every port.

Any wireless network works like a hub. The packets are broadcast to everyone around to listen. A protected network will encrypt the packet so only the intended clients will be able to decode the packet content, but anyone around will be able to listen.

On your case, even if normally the OS will not process any packet not addressed to it, any station in monitor mode (even those not associated) will be able to receive every packet, no matter if you have client isolation or not.

|improve this answer|||||
  • Makes sense and unfortunately as I thought might be the case. Just moved into an apartment block and that is how the wireless is set up. I can't use a VPN as it's in a country in which VPNs are not permitted. – gb5757870 Aug 23 '19 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.