"unresolved" or blank SSID?

MetaGeek Products Eye P.A.
1

Hello.
I received a new wifi setup, so of course, I have to do some learning :slight_smile:

In Eye P.A. I am seeing some “Unresolved” or blank “SSIDs” and was just curious what that could mean. I’ve never seen it before…

They are using management frames… mostly probe request/response so I was just wondering if it was my router doing passive scanning??

Any ideas? or thoughts?

2

Hi 23tcpipdhcp,

“Unresolved” frames can mean a few different things, I will list out some of the more common reasons:

  1. They could be packets in your environment sent using higher PHY types or data rates than what your adapter is capable of parsing. For example, some 802.11ax packets may show up as unresolved if captured using an 802.11ac or lower adapter. I discuss this more here at around the 34:00’ mark.
  2. These packets could be sent on a spatial stream that isn’t supported by your adapter. For example, if you are using a 2:2 spatial stream adapter, and your AP is capable of 3:3 spatial streams, all data sent on the third spatial stream will show up as “Unresolved” since your adapter is only capable of capturing on two spatial streams.
  3. It could mean that a device is not currently associated to an AP so it’s simply broadcasting or sending probe requests. I was able to find a more technical explanation of this by an engineer:

Most communication to/from the AP is to a specific client and has the client’s MAC in the receive or transmit address field. Beacons are sent from the AP to the broadcast address (FF:FF:FF:FF:FF:FF), Other packets are sent to a group of clients using multicast addresses. These show up in Eye P.A. as either ipv4 or ipv6 multicast (mcast), or spanning tree. Some packets are “unresolved” and given an address of FF:FF:FF:FF:FF:FE; I believe these packets are usually RTS, CTS, or ACK packets that only contain one address and leave the other address to interpretation based on the previous or next packet…

I hope this helps!

3

Hi Casey,

thank you for this useful and clear information.

Regards