WAP MAC ADDRESS - HELP!

[Koldov]

Hi All,

 

Today I was going to try to match up all the WAP MAC addresses, wall ports, transmitting channels etc. and plot them down on a map of the school.

 

Just thought I would wander around the school with a laptop running inSSIDer running to troubleshoot a few wireless issues but have got stuck on my first attempt.

 

I got to my first one, marked it on my map, noted the wall port number and copied the MAC address from inSSIDer. Then although it had the strongest signal, to be sure I had the correct one I unscrewed it from the wall to check the MAC address corresponded...

 

inSSIDer MAC address - 1C:17: D3:CA:2A:A0

 

WAP MAC address - 5475D0642277

 

I can't see any relationship between these numbers...

 

Can anyone shed any light on this for me please?

 

Kol.

[sted]

ones the mac for the wifi ones the mac for its lan port?

[mac_shinobi]

 

inSSIDer MAC address - 1C:17: D3:CA:2A:A0

 

WAP MAC address - 5475D0642277

 

 

Kol.

 

Guessing here but the inSSIDer MAC Address is the MAC Address of the WiFi card that is creating the wireless network

 

WAP MAC I presume is the MAC Address of the Physical NIC on The WAP that connects the WAP into your network ??

Edited October 14, 2013 by mac_shinobi

[Koldov]

Well, I was presuming the MAC address shown in inSSIDer was the MAC address of the WAP.

 

Here is a screenshot of the inSSIDer screen.

 

 

These are PoE Cisco WAP's that feed back through wall ports to Cisco switches in the core cab room.

 

I guess inSSIDer is picking up that MAC address from the WAP itself, but why does the WAP have a different number printed on the back?

 

What bugs me is the difference in the format of the numbers too, are they in hex? I can't get them to match up even converting them.

 

I've tried a couple now and the numbers don't correspond on any of them...

 

Any other (free) wireless network monitor tools I could use?

 

Kol.

Edited October 14, 2013 by Koldov

[mac_shinobi]

Well, I was presuming the MAC address shown in inSSIDer was the MAC address of the WAP.

 

Here is a screenshot of the inSSIDer screen.

 

[ATTACH=CONFIG]20895[/ATTACH]

 

These are PoE Cisco WAP's that feed back through wall ports to Cisco switches in the core cab room.

 

I guess inSSIDer is picking up that MAC address from the WAP itself, but why does the WAP have a different number printed on the back?

 

What bugs me is the difference in the format of the numbers too, are they in hex? I can't get them to match up even converting them.

 

I've tried a couple now and the numbers don't correspond on any of them...

 

Any other (free) wireless network monitor tools I could use?

 

Kol.

 

Use something like angry ip scanner to scan the subnets ( if you have more than one ) and sort the results by mac address and see if its finding the WAP's by the 5475D0 MAC address or by the one shown by inssider. I presume it will find them by the 5475D0 mac addresses

 

Also I suppose what mac addresses and other info you are trying to record for this report / map etc

[Koldov]

Hmmmm...

 

Angry IP scanner is giving me the same MAC for all wireless devices. Presume it's the wireless controller in the core cab room?

 

Kol.

[mac_shinobi]

Hmmmm...

 

Angry IP scanner is giving me the same MAC for all wireless devices. Presume it's the wireless controller in the core cab room?

 

Kol.

 

If they as in the WiFi AP's connect to a controller before going into the core or a switch then I presume its picking up the controllers mac addresses

 

If you logon to each controller is there a way to view the attached WAP's info for each area or departments that they cover ?

Edited October 14, 2013 by mac_shinobi

[Koldov]

I don't think I know the IP addresses for the controllers though, only the switches and they aren't giving me any info...

 

Kol.

[sted]

are these propper managed devices or "managed lite" weve installed/used cisco wireless before where there is no contoller as such the access points just share settings when you add them to a group so a change on 1 propagetes to all (so if i add another ssid on 1 they all get it for example).

[mac_shinobi]

Don't they have or give you an installation disc or maybe an application you can download from cisco to manage these WAP's or controllers that will scan your network for any of the controllers and do it through there application ( if they have one ) ?

 

Some RTFM'ing may be required, although http://www.edugeek.net/members/neilmac.html may be able to help ( @neilmac )

Edited October 14, 2013 by mac_shinobi

[Koldov]

Yes, they are proper managed devices. Unfortunately they are managed by a 3rd party (I'm unsure of all the details as they were installed before my time) and therefore there aren't any instructions for ICT techs who wan't to go meddling. I was really trying to avoid calling them for such a simple task, but it looks like I'm way over my head as usual...

 

Kol.

[neilmac]

Hi Koldov.

Both of those MAC's are valid Cisco MAC OUI's, so I suspect as has been pointed out that you are looking at the MAC of the Ethernet port.

 

What type of access points do you have (and what controller type ?)

 

If the access point gives out multiple SSID's, then each of those will have a unique BSSID (MAC address) that increments up from a root MAC address.

 

When a frame is received by an access point, the Distribution service will inspect the MAC headers and make a decision on how to handle the frame. If it's destined for a location on the wired portion f the network, the DS will hand the frame to the Integration Service, which strips off the 802.11 MAC header and replaces it with the 802.3 or Ethernet header. At that point the AP Portal MAC address is used (the ethernet port).

 

When we cover this in training courses, we do an exercise where we send a frame from a client device to an Access point, through the wired, over a bridged link then wired again to an access point and finally wirelessly to a client. By following the MAC header changed we demonstrate very clearly how the integration service and distribution service manipulate headers and MAC addresses to ensure delivery.

 

In terms of mapping the network, you are going to struggle to get any kind of meaningful coverage data with the tools you have.

 

InSSIDER uses probe response and beacon frames to show network information. The problem here is that they are management frames sent at the lowest data rate, so will only give you basic information. Management frames kind of travel further (* not strictly but it's the easiest way right now to describe it) so trying to map a nework like that will not give you any indication as to performance.

 

Performance is about delivering data frames, which are sent at higher data rates, which don't travel as far.

 

NM

Edited October 14, 2013 by neilmac

[mac_shinobi]

Yes, they are proper managed devices. Unfortunately they are managed by a 3rd party (I'm unsure of all the details as they were installed before my time) and therefore there aren't any instructions for ICT techs who wan't to go meddling. I was really trying to avoid calling them for such a simple task, but it looks like I'm way over my head as usual...

 

Kol.

 

I don't feel so bad / dense now but neilmac has replied above - not sure how much help that is but if you can reply with the information he is requesting he may be able to assist further without contacting the 3rd party ( will find out soon enough )

[Koldov]

Yup @mac_shinobi all well over my head too! That's one of the many problems with me being Jack of all trades and master of none! I know a little about everything, but nothing really with enough depth.

 

Thank you for your reply @neilmac in answer to your questions, most of the WAP's look like aironet 1130's or 1140's (I think, not sure of exact model) and the controllers in the comms room are 5508's into 3750 switches.

 

They are only broadcasting one SSID.

 

Yeah, I knew I wouldn't be able to do a really fancy network coverage map. Just really wanted to be able to map out which AP was where, what channel it was transmitting on and such. One or two rooms have complained of bad coverage and just walking round today I found one teacher (who has a WAP in the room) was actually connecting to one outside in the corridor because her laptop nic was set to connect to channel 11 only (the WAP in her room is on channel 6).

 

I just wanted a way to double check the WAP I was standing in front of was the one hitting inSSIDer with the best signal, so I wasn't really picking up one behind a door or something silly. I know it should be obvious, but there are a few in close proximity in one or two locations around the school.

 

Kol.