'Hidden Network' only when I am connected

CharlieEnFrance Posted messages 8 Status Membre -  
brupala Posted messages 111929 Registration date   Status Membre Last intervention   -

Hello,

For a week now, a hidden network has appeared on my Wi-Fi list – in my neighborhood, that is – a hidden network... no problem so far except that it disappears when I disconnect and reappears when I reconnect. Sometimes it disappears while I am connected, but basically, it looks like a duplicate of my own network, which is a distinctly different network.

This hidden network didn’t exist a week ago.

Moreover, my home was apparently 'visited' by someone breaking in just the day before (door left open, objects moved).

Is this a network created to spy on me? Is it possible to mirror one network onto another? Since then, I have changed the passwords for my box and my Wi-Fi, and removed all the 'connected/offline devices.'

By the way, in the list of offline devices, by researching the corresponding 'MAC' codes, I found an unknown computer and an 'Amazon device'!! I have never had anything like Alexa or anything else.

My question: how can I delete or block this parallel hidden network?

Thank you.

6 réponses

CharlieEnFrance
 

Hello,

Let me explain again with today's attempts to see what it is:

As soon as I connect to my Wi-Fi (by clicking on my network in the list of networks displayed at the bottom right, bar on Windows next to the date/language): there is, and this has been the case for just 8 days, a hidden network (I have it in English, "hidden network").

I disconnect: the network disappears. I reconnect: it reappears. I disconnect: it disappears, etc., etc.

It shows a maximum of "bars" of connection: excellent network, as if it were in my room. Knowing that I live in a stone house, with walls 1 meter thick, all the Wi-Fi networks in the neighborhood appear with 1 or 2 bars at most, this excellent connection is strange.

I called my internet provider, who checked and saw nothing (previously I had looked at the configuration interface of my box: there is only me connected (one person only) and devices: none other. I searched for MAC addresses with everything I found in the device history. I deleted everything except my computer.

My internet provider tried to see on their side: they see nothing. We reset my box, restarted my computer: the hidden network is still there! They told me that it could not come from my box but from my computer (virus or something ...).

I did the "cmd" command with the "netsh..." thing, on the black screen, to block this hidden network, as suggested in tutorials: the hidden network is still there!

There can't just be 2 of us with this problem: other people must be having this issue.

I'm thinking of a virus or someone malicious in my circle, since I went to several people's places with my computer (protected by a password but still).

1
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417
 

OK,

can you scan the wifi networks with the tool I mentioned this morning or others on Windows, there's Acrylic or inSSIDer

to compare the BSSID of the hidden network to that of your router.

By the way, what kind of router do you have? Do you have a repeater?

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   1 587 > brupala Posted messages 111929 Registration date   Status Membre Last intervention  
 

I use Wifi Analyzer (by Matt Hafner), available in the Microsoft Store.

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   1 587
 

The command "netsh wlan show networks mode=bssid" will show you all the Wi-Fi networks, both hidden and visible, around your computer.

These are the networks that are broadcasting around your computer, you cannot remove them from your computer. You can only avoid connecting to them.

You will find hidden networks in this list under a line that starts with SSID, but with no name after the colon.

You will then have a list of BSSID below, one for each hidden network.

Example:

 SSID 4 : Network type : Infrastructure Authentication : WPA3-Personal Encryption : CCMP BSSID 1 : 22:b8:2b:8f:53:e0 Signal : 46% Radio type : 802.11ax Band : 5 GHz Channel : 100 Hash-to-Element: : Not supported Bss Load: Connected Stations: 2 Channel Utilization: 32 (12 %) Medium Available Capacity: 0 (0 us/s) Basic rates (Mbps) : 6 24 Other rates (Mbps) : 9 12 18 36 48 54 BSSID 2 : 06:e3:1a:f1:c1:c2 Signal : 35% Radio type : 802.11ax Band : 5 GHz Channel : 100 Hash-to-Element: : Not supported Bss Load: Connected Stations: 0 Channel Utilization: 28 (10 %) Medium Available Capacity: 0 (0 us/s) Basic rates (Mbps) : 6 24 Other rates (Mbps) : 9 12 18 36 48 54 BSSID 3 : 7a:da:88:4d:de:5f Signal : 85% Radio type : 802.11ac Band : 5 GHz Channel : 36 Hash-to-Element: : Not supported Basic rates (Mbps) : 6 12 24 Other rates (Mbps) : 9 18 36 48 54 BSSID 4 : 7a:da:88:4d:da:86 Signal : 40% Radio type : 802.11n Band : 2.4 GHz Channel : 8 Hash-to-Element: : Not supported Basic rates (Mbps) : 1 2 5.5 11 Other rates (Mbps) : 6 9 12 18 24 36 48 54
0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417 > yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention  
 

yes, that works too.

0
CharlieEnFrance > yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention  
 

it's (Wifi Analyzer) an app for phone and I downloaded it but it asks me for geolocation to work and I never turn it on (being tracked by someone, so it's a security measure)...

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417
 

Hello,

several things ...

1/ masked networks, especially in urban environments, as there are more and more wifi networks; we will also see more of them because people are rightly installing mesh wifi systems, and the mesh wifi boxes are connected to each other via private and masked networks.

Furthermore, in companies, all networks outside of public wifi are also masked for protection.

2/ unknown and multiple mac addresses on a network are becoming more and more numerous today if you are administering a network; all modern machines (mac/iphone/windows 11) have wifi cards with random mac addresses that change almost every time they disconnect or switch networks in the name of privacy preservation:

random mac configuration © screenshot brupala

So all of this is not a basis for developing paranoid theories


And there you go, here it is ....

But misery, how annoying the line spacing is!!

0
zouk
 

Hi

How do you delete a wifi network that we've detected in the environment?

Are you serious?

Because in France it's possible, it's the military that takes care of it as soon as it's waves that disturb people (any police station, it's the army). But are you sure that this network bothers you?

0
brucine Posted messages 24373 Registration date   Status Membre Last intervention   4 094
 

Hello,

Are you also being paranoid?

The handling of signal interference is not the responsibility of law enforcement but of the ANFR, which can, if necessary, refer the matter to the public prosecutor or directly to a judicial police officer.
https://www.anfr.fr/controler/traitement-des-brouillages/le-traitement-dun-brouillage-comment-ca-marche-de-la-demande-dintervention-a-la-resolution

For many years now, the gendarmerie, while being an armed force, is under the authority of the Minister of the Interior for its civil missions: the nature of the public force, gendarmerie or police, depends only on which has authority over the area concerned by the presumed offense.

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417 > brucine Posted messages 24373 Registration date   Status Membre Last intervention  
 

The ANFR does not intervene in wifi jamming issues; fortunately for it, wifi frequencies are part of the free frequencies that everyone can use for transmission without special authorization, just as long as they stay within the maximum power standards (EIRP), somewhat like the CB band or portable marine VHF.

All other frequencies are subject to usage licenses.

0
CharlieEnFrance Posted messages 8 Status Membre
 

Hello,

I am surprised by your response. Clearly, you did not read my message in full: violation of my home, and this is the continuation of a series of offenses....

In short: what is the meaning of your response regarding the "treatment of signal disturbances...gendarmerie...Prosecutor"?

Your answer is enigmatic and I have the impression it is mocking.

0
brucine Posted messages 24373 Registration date   Status Membre Last intervention   4 094
 

I did not talk about the consequences following a break-in, but the so-called role that would be played by the gendarmerie regarding possible disruptive waves as stated in <2>

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417
 

I answered you on a technical level, it's the only one where I can do so; detective novels are not my cup of tea.

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417
 

Also,

how do you see a hidden network?

To see a hidden network, you need to scan for Wi-Fi networks; otherwise, Windows won't show it.

0
brucine Posted messages 24373 Registration date   Status Membre Last intervention   4 094 > brucine Posted messages 24373 Registration date   Status Membre Last intervention  
 

Assuming, moreover, that I engage in activities interesting enough for my communications to be worth diverting, the public or private agency that undertakes this won't be foolish enough to leave traces, particularly of a break-in; it's counterproductive.

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   1 587 > brupala Posted messages 111929 Registration date   Status Membre Last intervention  
 

Hello,

Windows shows the presence of hidden networks in the list of available Wi-Fi networks, without needing to perform a special scan.

If Windows did not display them, it would be difficult to connect to them. When requesting Windows to connect to a hidden network, you need to enter the network name.

2
CharlieEnFrance
 

Thank you Yb8_ge: here are 2 screenshots of the results (I have obscured the name of my Orange network. I have a Flybox. Why do I have two BSSIDs?) 2nd screenshot in the following message.

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417
 

The one that is masked must be this SSID2 instead

Your box is rather the SSID3 which has two BSSIDs because there is a different one for the 2.4 GHz and 5 GHz networks

screen copy © Charlie

The SSID 2 has two BSSIDs in 2.4 GHz, one quite weak and the other much stronger, it must have two different access points, with one closer to you, the more distant one on channel 11 and the closer one on channel 4.

If you had the scanner on your mobile, you could locate it more precisely, but hey ...

After all, nothing says they are on the same network, but it's likely.

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   1 587 > brupala Posted messages 111929 Registration date   Status Membre Last intervention  
 

The SSID 2 is presented as a single SSID with two BSSIDs, but Windows is unaware of this, the SSID being hidden. It seems more likely to me that these are two different hidden networks.

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417 > yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention  
 

or two access points of the same network with a hidden SSID, few people bother to hide their network, as I mentioned at the beginning, this is more common in businesses.

In any case, it doesn't seem to be coming from the box, even if it was a hidden guest network, I think we would have a BSSID closer, as is the case between the 2.4 and 5 networks.

Moreover, it's on WPA3, not the box.

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   1 587 > brupala Posted messages 111929 Registration date   Status Membre Last intervention  
 

By disconnecting the Orange modem, it is easy to check if these two BSSIDs remain active.

I wouldn’t rely too much on the information that Windows shows about the hidden "SSID," as it can group several different networks. At my place, I find in this private SSID the backhaul BSSIDs of my mesh as well as those of my neighbors' mesh.

0
brupala Posted messages 111929 Registration date   Status Membre Last intervention   14 417 > yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention  
 

One could also think of a Wi-Fi bridge, connected via Ethernet to the router, which would indeed fuel the paranoia; if the access point of the bridge on that side is configured with a static IP, it won't attempt to communicate with the router (no ARP, no DHCP discover), and the machines on the other side of the bridge won't either, if they are also set to static IP or have IP protocol disabled, and only sniff, but at this level, they will only see broadcasts and multicasts, not useful traffic, so it’s complicating life for nothing.

0
yg_be Posted messages 23437 Registration date   Status Contributeur Last intervention   Ambassadeur 1 587
 

It would have been nicer to share text, not images.

You currently have 3 unsecured Wi-Fi networks around you: Orange-XXXX, Livebox-CF00, and Freebox_PFGACD.

And one or two hidden networks, let's say 2.

The first hidden one, BSSID DE00B0........, is not very close, probably emitted by one of the boxes. This is an "artificial" MAC address, not associated with a hardware provider.

The second hidden one, BSSID D4A6513F82D0, is very close, like your Orange modem. The MAC address is associated with the provider "Tuya Smart Inc."

You don't have any smart home devices at home?

You could try to locate this equipment by checking where you get the highest signal level when you move your computer and redo the netsh command. It might be easier to do this on a phone with an app like Wifi Monitor. Or you could turn off each electrical circuit and see at what point this network disappears.

I remain surprised that this network disappears when you disconnect your computer from the Wi-Fi network. When your computer is disconnected, netsh should show all networks, just like when it's connected. Can you check if that's not the case?

0