I swapped out a dead router at home today. I setup the new router with the same SSID and encryption settings. The devices on my network acted like nothing had happened and are happily connected to the new router.


If I swap out a physical host or VM using the same IP and using SSH for example, connect to that host, the thumbprints are different and problems ensue. Why does this not happen when switching out a router? I could think of a few cases where this could be done maliciously, so I'm surprised it works like this.

  • 2
    Because there is no mechanism for fingerprinting APs in WiFi.. at least without extending it. Plus, things like roaming between APs and mobility would be negatively impacted.
    – NickW
    Commented Jan 30, 2014 at 16:49
  • @NickW Some clients use the MAC of the AP as a fingerprint. I know something I own does this and it's more annoying than anything; roaming from one AP to another produces error messages.
    – Chris S
    Commented Jan 30, 2014 at 16:51
  • @ChrisS I'd imagine it could be done, but anyone competent could spoof the same MAC, it's about as useful as MAC filtering on an AP.
    – NickW
    Commented Jan 30, 2014 at 16:58
  • 2
    Because the SSID and wifi encryption settings occur at layer 2 of the OSI model. Think of it like a physical switch. If my computer is hooked into an Ethernet switch, and I replace the switch, my computer will normally function the same afterwards. There is no fingerprint comparison, etc. MitM attacks are possible at this layer, and many security tools actually listen to the packets at this layer. Commented Jan 30, 2014 at 17:39
  • Great responses, why are these not answers?
    – bn.
    Commented Jan 30, 2014 at 17:48

3 Answers 3


WiFi access points have no secret. They use a SSID, but they otherwise offer or know nothing that the client can validate. Every time a device (say, a laptop) connects to a WiFi router, it uses it as if it was a new router and expects nothing in particular from that router. Secrets are more on the client side: the router will require the device to demonstrate knowledge of the WiFi password.

With a SSH server, the server has a private/public key pair, and shows the public key, and the client records that public key. If the client reconnects, then it will require that the server uses the same public key as previously; otherwise, it will complain loudly (as you observe).

There is no such public key in a WiFi router. Clients are not actually interesting in knowing whether the router has changed or not, because the router is only meant to route data to the Internet, not to provide access to some sensitive data or receive sensitive data.

When you talk to your banker, you want to be sure that you have a genuine banker with you, because you will give him your money. When you talk to the cashier at a supermarket you don't care whether he is a real cashier or not, as long as you get to exit the supermarket with the food and security guards don't begin to shout at you.

  • The first paragraph implies that, any device could pose with the SSID, and even if the client provides a password the man in the middle wifi router can say 'yep looks good whatever..' and sniff all incoming traffic. The AES-256 bit encryption would not even need to be broken. Is that correct?
    – Seth
    Commented Sep 29, 2014 at 10:47

Essentially the security on a wireless network is provided in the encryption key (for WPA2-PSK and WEP protected networks) or the authentication process for WPA2 enterprise networks).

An attacker who can get physical access to the access point and then replace it with their own hardware can compromise the security of the network (assuming they can extract the key from the device), so that's what needs to be protected to protect the system.

In the example you give about SSH it's that key exchange which provides the security so changing it causes alerts. The analagous situation in a wireless network would be an attacker setting up an Access Point with the same SSID but a different key.


As @Stefan Lasiewski, mentioned in a comment in a typical network there is little to no security down at the layer data link layer of the network (see OSI model).

But there are features present in some switches, and wifi devices to implement 802.1x which is a technology that provides for authentication and encryption at the link layer. These features are not present on low-end wifi equipment like you might find in your home since administering is very complex and the effort required to configure it properly is far beyond the risk most people face.

  • PPP is one way of improving security at (a virtual) layer 2. EAP-TLS allows secure mutual authentication between a client and authentication server, it's a bit enterprise-y though. Commented Jan 31, 2014 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .