cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Rouge SSID on VLAN - What is it?

Comes here often

Rouge SSID on VLAN - What is it?

Hello all,

I've been unsuccessfully trying to figure out what is broadcasting as with these random SSID's on my network for some time to no avail. They are actually connected to a vlan so it seems that they had to be manually connected by someone. I just don't know the device.

Even though it gives me the MAC address, when I look on the switches to see what port the MAC address is tied to, the MAC addresses aren't there.

Any idea what this might be?  See attached screenshot from the Air Marshall.

Thanks.Capture.JPG

5 REPLIES 5
Building a reputation

Re: Rouge SSID on VLAN - What is it?

1 - Which MAC are you looking at on your switches ? The Wired MAC or the Wireless MAC ?

 

2- Those rogue SSID are often printers with Direct printing , Phones with HotSpot enabled , PC with some features similar to Direct printing.

 

I would take for example this wired MAC :  00:1e:c0:xx:xx:xx from your screenshot . Look it up on my switches , find where this device is at , go on that device and check why it is broadcasting XXXX SSID. 

Highlighted
Kind of a big deal

Re: Rouge SSID on VLAN - What is it?

@RaphaelL is right. Most of the time it will be:

 

2- Those rogue SSID are often printers with Direct printing , Phones with HotSpot enabled , PC with some features similar to Direct printing.

Comes here often

Re: Rouge SSID on VLAN - What is it?

I'm using the MAC address that's on the screenshot which is labeled as the broadcast and wired MAC - its the same thing. As mentioned I look on my switches and the MAC addresses aren't there on the switches.

Building a reputation

Re: Rouge SSID on VLAN - What is it?

Curious , what happens if you click on the client in Air Marshal ?

 

You should have additionnal informations about the client in the bottom right corner of your dashboard. Maybe you will notice a different MAC.

 

Also what equipement is doing your DHCP ? 

 

 

Comes here often

Re: Rouge SSID on VLAN - What is it?

The MX is acting as the DHCP server - the client is listed as device name WiFly-GSX and Manufacturer as Microchip Technology. Same MAC.

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.