Results 1 to 2 of 2

Thread: Shadow router?

  1. #1

    Default Shadow router?

    I am a new user of inSSIDer 2.0.

    I am monitoring my Belkin modem-router and this shows up perfectly on inSSIDer - with the correct MAC address, SSID, Channel and Vendor.

    However a second entry is shown with a MAC address of 00:00:00:00:00:00 but with the correct SSID and Channel. The Vendor is shown as XEROX, although to the best of my knowledge, I don't have any XEROX equipment!

    Could anyone please explain what this is and whether it might be interfering with my Belkin network? (The XEROX RSSI is usually slightly lower than the Belkin one and it also seems to be dropped completely from time to time.)

    Many thanks for any help.

    ARGONAUT

  2. #2

    Default

    While I have not noticed the 00:00:00:00:00:00 in insider before, I have seen it show up in in other tools and the AirPCap. The XEROX referene will simply be a "guess" based on the frist few bytes of the MAC (eg: 00:00:00) but all 00 are normally used in transmitting a broadcast packet (eg: ARP whois).

    Without seeing how much traffic you are getting from it, its a little hard to say if its causing you any issue, but I would expect that it is not.

    While this would not explain why its seen as an AP, a device on your wired network could have sent a packet with its source mac set to 00:00:00:00:00:00 and broadcast to the network. This will mean your AP will forward it as needed, so the AP will be the return path of that 00 device (kinda like an arp proxy) acting like a bridge.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •