Wireless Air Marshal detecting SSID: "DIRECT-"

[JinsengIT]

I'm not sure where else to post about this, so I'm starting here.  For years, our Air Marshal has detected a rogue SSID called "DIRECT-".  Since it appears on our LAN, we block it.  I'm now looking deeper and would like to understand what this might be.  I speculate that it could be our Samsung TVs or Windows devices attempting to do screen mirroring using Direct Connect.

I checked the broadcast MACs in a MAC address lookup site, but it couldn't find any of them.

I know this isn't much to work from, but does anyone have any speculation about what this may be, how to confirm, and if it may be safe to add to the SSID Allow list so we don't receive email warning notifications about it?

Thanks for any thoughts you have.

[Purroy]

99% it will be an HP Direct printer that is connected to your LAN and its WiFi has not been configured or disabled. 

[Paccers]

+1 for printers most likely for the direct print functionality

[txhomer]

We get alerts like that too and I'm pretty sure it's laptops broadcasting an SSID while also being connected to the LAN

[JinsengIT]

Thanks for the thoughts.  We're going to look into the printers and TVs.  The thing that's making this harder is that the SSID is exactly "DIRECT-".  Other examples I've seen in my research have a description after the hyphen.  I wish that was the case here.

[Jaanderson]

Hi Jinseng, did you ever figure out what the SSID was with exactly "DIRECT-" as the SSID? I'm experiencing the same thing and would be great to know. Thank you!

[School_admin]

Hello,
At our school, it is the projectors that broadcast this ID
Since we use the Miracast function of the projectors.
At the beginning, our devices that are in our WLAN could not connect to it and I have entered a corresponding exception rule that everything with the SSID “DIRECT-*” Meraki is allowed.
I only stumbled across this after I used a device that is not integrated in our WLAN.

[JinsengIT]

Unfortunately, we never found anything definitive.  It may be Miracast screen sharing devices or Samsung TVs, but we're not positive.

[School_admin]

Hello,
At our school, it is the projectors that broadcast this ID
Since we use the Miracast function of the projectors.
At the beginning, our devices that are in our WLAN could not connect to it and I have entered a corresponding exception rule that everything with the SSID “DIRECT-*” Meraki is allowed.
I only stumbled across this after I used a device that is not integrated in our WLAN.