Do hidden networks send beacons? I have seen hidden networks in backtrack and Ubuntu using airodump-ng. The output is weird like the power is shown as -1. Why does this happen? enter image description here

enter image description here

As you can see here there are no beacons for a hidden network.

  • 1
    You have sniffed the packets sent by the clients, but you are out of reach from the AP. That's why you don't know the SSID and you have no beacons, but you still know that it exists. – LatinSuD Jul 7 '14 at 17:45
up vote 8 down vote accepted
+50

Yes, hidden network still send a beacon frame, just without the SSID.

Your wireless hardware sends the estimated received power level to Aircrack-NG. It could be due to unsupported hardware or your hardware is not able to come up with a good power figure for the signal. Check out this forum for some older info, and look at their hardware compatibility list

  • So how can we figure their SSID with aireplay-ng if no beacons are sent? – M.Tarun Jun 21 '14 at 17:12
  • 1
    You can disassociate the client from the AP, then read the association packets. See Aireplay-NG help#hidden_ssids_length – Mat Carlson Jun 21 '14 at 17:17
  • 1
    I don't believe so - I believe that it essentially sends a lot of malformed packets to the AP using the valid client MAC. After association, the packets don't have to have a SSID anymore, since the association is between MAC addresses on a specific frequency. – Mat Carlson Jun 21 '14 at 17:24
  • 1
    If i use aireplay-ng for deauthenticating an access point that is hidden it waits for the beacon from the access point like : Waiting for beacon frame (BSSID: D4:4C:24:2B:EE:80) on channel 1. – M.Tarun Jun 21 '14 at 17:28
  • 1
    Let us continue this discussion in chat. – M.Tarun Jun 21 '14 at 17:38

The beacons are still sent, however the SSID field is set to NULL. You can learn the SSID when a client is in fact connecting. This can be done through being patient, or by spoofing a deauthentication frame coming from the client.

Instead of increasing the security posture, I think that the security is instead weakened by turning off the SSID broadcast. What is instead happening is that clients will start beaconing for the network with the appropriate SSID EVERYWHERE THEY GO. So your clients, wherever they may be, will be asking for the appropriate network everywhere, potentially revealing information about your clients that they don't want to share. E.g. if you've been on a "business trip" and visited a wireless network of the name "Shady Lady Ranch". Uou don't want your colleagues to know you visited there, however they can simply sniff the traffic when you arrive back at the office, and they will see you probing for the network, revealing that you've been previously connected.

All in all, the beacons are still being sent, however the job to specify the SSID is now burdened on the client instead of the AP.

  • Can't we deauthenticate the clients using aireplay-ng? – M.Tarun Jul 7 '14 at 15:52
  • @M.Tarun yes with the --deauth option – Chris Dale Jul 7 '14 at 19:49
  • But when I try to use it it just shows Waiting for beacon frame (BSSID: D4:4C:24:2B:EE:80) on channel 1. – M.Tarun Jul 8 '14 at 3:53
  • Try not to lock yourself on channel 1. There is 14 channels to sniff on, try some channel hopping and see if your result improves. – Chris Dale Jul 8 '14 at 6:45
  • The result is same – M.Tarun Jul 10 '14 at 8:34

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.