Air Marshal Spoofs - trying to make sense of MAC addresses reported

[AlexG7]

Hi all,

I'm troubleshooting network where we get a lot of WiFi drop-outs reported (users lose connectivity for a while).

I had a look at Air Marshal and got confused with finding.

I could, sort of, recognize MAC addresses, still would like to know how the base address of MX get's manipulated in different SSID-s etc.

Also, would E2:CB:AC:34:84:83 be Meraki range still or it's a real spoof?

[SoCalRacer]

Might want to look this doc over

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Mitigating_a_Spoofed_AP

[BrechtSchamp]

So you have your MR SSID actually broadcasting on your MX too? It's not recommended to combine the wireless on an MX with actual MR's in the same location as they're completely separate things and roaming between them will be an issue. In this case, your MR's air marshal detects the MX as rogue SSID.

However if you do decide to continue down this path, you can whitelist the MX's MAC address in the whitelist in Wireless > Air Marshal.

Might want to make sure that the MAC address you see is indeed the wireless interface's MAC address of the MX first. I'd just change the SSID name on the MX for a few minutes and have a (windows) client execute the following netsh command:

netsh wlan show networks mode=bssid

 It'll show all detected SSIDs and the MAC address of the base stations broadcasting them. If you find e2:cb:fc:22:ce:b1 again, you can be sure it's the MX's wireless interface's MAC address.

[AlexG7]

Thanks, that makes sense...actually, I've already done the steps described...

However, really needed to find out if there's any manipulation of Meraki-s device base MAC address.

Please refer to the attached screenshot.

I was expecting any offset in MAC address to be in last octets, but didn't know how to interpret the changes in the first octet?

Thanks,

Alex

[pjc]

@AlexG7  Isn't the MAC address reported in Air Marshall the BSSID MAC address of the SSiD it's seeing ?  That's a variant of the physical mac address of the AP that's broadcasting it.  The algorithm to work it out is based on the radio band, the mac address and the model of the AP

More info here on how to work it out

https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Calculating_Cisco_Meraki_BSSID_MA...