Rouge SSID on VLAN - What is it?

[seabreeze]

Hello all,

I've been unsuccessfully trying to figure out what is broadcasting as with these random SSID's on my network for some time to no avail. They are actually connected to a vlan so it seems that they had to be manually connected by someone. I just don't know the device.

Even though it gives me the MAC address, when I look on the switches to see what port the MAC address is tied to, the MAC addresses aren't there.

Any idea what this might be?  See attached screenshot from the Air Marshall.

Thanks.

[RaphaelL]

1 - Which MAC are you looking at on your switches ? The Wired MAC or the Wireless MAC ?

2- Those rogue SSID are often printers with Direct printing , Phones with HotSpot enabled , PC with some features similar to Direct printing.

I would take for example this wired MAC :  00:1e:c0:xx:xx:xx from your screenshot . Look it up on my switches , find where this device is at , go on that device and check why it is broadcasting XXXX SSID. 

[kYutobi]

@RaphaelL is right. Most of the time it will be:

2- Those rogue SSID are often printers with Direct printing , Phones with HotSpot enabled , PC with some features similar to Direct printing.

[seabreeze]

I'm using the MAC address that's on the screenshot which is labeled as the broadcast and wired MAC - its the same thing. As mentioned I look on my switches and the MAC addresses aren't there on the switches.

[RaphaelL]

Curious , what happens if you click on the client in Air Marshal ?

You should have additionnal informations about the client in the bottom right corner of your dashboard. Maybe you will notice a different MAC.

Also what equipement is doing your DHCP ? 

[seabreeze]

The MX is acting as the DHCP server - the client is listed as device name WiFly-GSX and Manufacturer as Microchip Technology. Same MAC.