BSSID / ESSID
Definition
BSSID is the MAC address of the access point (or virtual AP). ESSID is the human-readable network name broadcast in beacons. Multiple BSSIDs can share one ESSID in an enterprise WLAN; an evil twin reuses the ESSID with a different BSSID.
- BSSID
- MAC address of the access point
- ESSID
- Human-readable network name
- Relationship
- Many BSSIDs can share one ESSID
- Attack pattern
- Evil twin reuses ESSID, new BSSID
- Field
- Wireless network forensics
Common questions
How does examining BSSID and ESSID together help detect a rogue access point?+
A legitimate network's known BSSID list can be compared against captured beacons; an access point broadcasting the same ESSID from an unrecognised BSSID is a strong indicator of an evil twin or rogue AP.
Why can one ESSID map to several BSSIDs on a legitimate network?+
Enterprise Wi-Fi deployments often use multiple physical access points across a building, each with its own BSSID, configured to broadcast the same ESSID so client devices can roam between them.
Related terms
- 4-Way Handshake
- The WPA/WPA2 key-establishment exchange between client and AP. Captured frames let an offline dictionary attack recover a weak PSK. WPA3 replaces this...
- Evil Twin
- A rogue AP broadcasting the same ESSID as a legitimate network at a stronger signal, so clients with cached profiles auto-associate. Often...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- KRACK
- Key Reinstallation Attack, CVE-2017-13077, disclosed by Mathy Vanhoef in 2017. By replaying message 3 of the 4-way handshake, the client is forced...
- PMKID Attack
- A 2018 technique by Jens Steube (hashcat author) that derives the Pairwise Master Key Identifier from a single EAPOL frame the AP...