Wireless

From time to time,  I get alerts about BSSID Spoofing detected but I have never found out why.  I've looked up what it means it has detected, 

" A device with signal strength of -30dBm or worse is broadcasting the same BSSID as an AP with a good signal strength. " 

But the Alert says something like this example:

APs - d4:20:b0:84:ea:1b

SSIDs avusd

BSSIDs - d4:20:b0:bb:60:91

Hostnames - RVAL-RM2401

That mac address is the AP listed and it is one of our Mist APs.  However, when I search my APs at that site and make sure I am displaying all the BSSIDs for 2.4, 5, and 6 Ghz,  I don't find that listed BSSID.  I also don't see that this AP has a lower transmit power than any other AP. 

What are my next steps to find what AP Mist is trying to alert me about? 

------------------------------
JOHN WILLIAMSON
------------------------------

Hi John, 

I hope you are well. 

If the RSSI value is lesser than -37dBm or -40dBm then this device would be detected as BSSID spoofing device. In this kind of case where power is good then it can be investigated with our technical support team or you can take the captures and check for the SSID broadcast packet to check further.

But i would suggest increasing power to the AP and see if alert goes away, if not then you can open a case with our technical team by using support ticket as indicated below. 

Vijaypal Khyalia

Staff Technical Service Advisor 

JNCIE-ENT #952, CCIE#56675, JNCIP(ENT,DC,SP) , JNCIS-MISTAI (Wired & Wireless)

---------------------------------------------------------------------

Juniper Networks

m: +44 1372389147  

e: vkhyalia@juniper.net 

www.juniper.net

 

Vijaypal Khyalia | LinkedIn

------------------------------
Vijaypal Khyalia
Juniper Networks
------------------------------