Hidden SSID Rogue AP Detection via Client Probe Requests

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Unauthorized access points with hidden SSIDs pose a vulnerability by allowing unauthorized access and bandwidth theft, as existing techniques fail to prevent their initial connection to wireless devices.

Innovation Solution

A method to identify unauthorized access points with hidden SSIDs by parsing MAC addresses from probe requests, enabling security actions such as channel switching and firewall rules to prevent association with these points.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the hidden SSID feature is enabled on unauthorized access points, then the access points become invisible to devices searching for networks, but this creates a vulnerability that allows unauthorized access and bandwidth theft

Engineering Contradiction:

Improvenetwork securityVSAvoiddetection of unauthorized access points

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system continuously monitors the wireless environment by capturing probe requests from wireless devices and analyzing them for SSID information. This feedback loop enables the system to detect hidden SSIDs that would otherwise be invisible, allowing for real-time identification and remediation of unauthorized access points while maintaining network security

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent uses probe requests as an intermediary mechanism to expose hidden SSIDs. Instead of directly detecting the hidden SSID broadcast, the system captures the SSID information embedded in client probe requests, which inadvertently reveal the hidden network identifier. This intermediary approach allows detection without requiring direct interaction with the unauthorized access point

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If existing techniques detect rogue access points already associated with wireless stations, then some unauthorized access points can be identified, but these techniques fail to prevent connection in the first place and cannot detect hidden SSIDs

Engineering Contradiction:

Improvedetection accuracy of unauthorized access pointsVSAvoidtime for security response

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary detection by monitoring probe requests before wireless devices establish connections with unauthorized access points. By analyzing probe requests that contain SSID information, the system can identify potential rogue access points in advance, enabling preventive security actions rather than reactive responses after association occurs

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12532176B2Identifying hidden service set identifiers (SSIDs) of unauthorized access points on a wireless network

Publication Date: 2026.01.20 FORTINET INC

AI summary

An unauthorized access point is identified during a periodic scan on the wireless network and storing a MAC address for the unauthorized access point and monitored for connection attempts. The unauthorized access point, due to having a hidden SSID, is monitored by the MAC address for data packets sent and received. At least one client associated to the unauthorized access point is identified from the data packets by MAC address. The at least one client is monitored, by the MAC address, for a probe request sent to the unauthorized access point. Responsive to detecting the probe request, an SSID of the unauthorized access point is parsed. A security action on the unauthorized access point using the SSID.