How 2 find an SSID after you've connected to hidden SSID that shares the same hardware (MAC address)?

[Bryan Kadzban]

George S. Lockwood wrote:
> b) connecting / authenticating to a hidden SSID of the same MAC 
> address.

Does this even *work*?  Doesn't the client get confused when it sees two
APs with the same BSSID?  I'd suspect that many clients would use a
lookup table keyed by BSSID, so two different ESSIDs running on the same
BSSID would really confuse them.

> What I find when I connect is the broadcasted SSID is no longer 
> detected and the once hidden SSID is.

Sounds like the driver is indexing a table by BSSID.  When it sees a new
beacon (or more likely in your case, a probe response) from a BSSID that
it saw before, it replaces that entry instead of adding another entry.

(Because if it didn't do this, how would it handle the case of an admin
changing the SSID on a single AP?  It would see the same thing -- a new
beacon from the same BSSID.  In that case, it would *have* to replace
the existing entry with the new one.)

> Is this expected behavior?

At least in NDIS, the results from an OID-get on BSSID_LIST completely
depend on the driver.  You get back whatever the driver provides.  If
the driver overwrites its entry, you won't see the original.

> It would seem that the NIC that was connected remains in a state that
> prevents it finding that particular SSID...for a long time.

I would guess it's the driver, not the NIC.  The only thing the NIC does
is accept a frequency, and send/receive frames on that frequency.  AFAIK
no NIC processes the wireless frames itself.  (Well, apart from the
encryption and decryption in some cards, that is.)

Instead of having one BSSID handle multiple SSIDs, you should probably
look into the multiple-BSSID code in the Devicescape stack.  Or if
you're not using hostapd, look into another AP that can do multiple
BSSIDs.  That setup requires much less from clients; many more clients
do the right thing when the AP is set up that way.  This is because it
looks to the client just like two physical APs.  (The other option is to
use Microsoft's WISP IE to "append" SSIDs to your beacon frames.  But
that requires specific support in the client as well, so mBSSID still
works better.)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20061012/921ddfe8/attachment.pgp