cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Air Marshal Spoofs - trying to make sense of MAC addresses reported

Highlighted
Here to help

Air Marshal Spoofs - trying to make sense of MAC addresses reported

Hi all,

I'm troubleshooting network where we get a lot of WiFi drop-outs reported (users lose connectivity for a while).

I had a look at Air Marshal and got confused with finding.

I could, sort of, recognize MAC addresses, still would like to know how the base address of MX get's manipulated in different SSID-s etc.

Also, would E2:CB:AC:34:84:83 be Meraki range still or it's a real spoof?

 

Spoofs forum question.png

4 REPLIES 4
Highlighted
Kind of a big deal

Re: Air Marshal Spoofs - trying to make sense of MAC addresses reported

Highlighted
Kind of a big deal

Re: Air Marshal Spoofs - trying to make sense of MAC addresses reported

So you have your MR SSID actually broadcasting on your MX too? It's not recommended to combine the wireless on an MX with actual MR's in the same location as they're completely separate things and roaming between them will be an issue. In this case, your MR's air marshal detects the MX as rogue SSID.

 

However if you do decide to continue down this path, you can whitelist the MX's MAC address in the whitelist in Wireless > Air Marshal.

image.png

 

Might want to make sure that the MAC address you see is indeed the wireless interface's MAC address of the MX first. I'd just change the SSID name on the MX for a few minutes and have a (windows) client execute the following netsh command:

 

netsh wlan show networks mode=bssid

 

 It'll show all detected SSIDs and the MAC address of the base stations broadcasting them. If you find e2:cb:fc:22:ce:b1 again, you can be sure it's the MX's wireless interface's MAC address.

Highlighted
Here to help

Re: Air Marshal Spoofs - trying to make sense of MAC addresses reported

Thanks, that makes sense...actually, I've already done the steps described...

However, really needed to find out if there's any manipulation of Meraki-s device base MAC address.

Please refer to the attached screenshot.

I was expecting any offset in MAC address to be in last octets, but didn't know how to interpret the changes in the first octet?

 

Thanks,

Alex

 

Building a reputation

Re: Air Marshal Spoofs - trying to make sense of MAC addresses reported

@AlexG7  Isn't the MAC address reported in Air Marshall the BSSID MAC address of the SSiD it's seeing ?  That's a variant of the physical mac address of the AP that's broadcasting it.  The algorithm to work it out is based on the radio band, the mac address and the model of the AP

 

More info here on how to work it out

https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Calculating_Cisco_Meraki_BSSID_MA...

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.