wifi-spotting – Monorail

Some wifi spotting (or wifi watching) at a hardware and home improvement store in Milano, Italy. I went there to buy a set of TORX tamper-resistant drivers to unscrew an old AP at the office and found myself looking at the ceiling all the time.

It’s a huge warehouse about 10m high with industrial metal shelves packed full of metal hardware, tools, building materials, piping, electric gear and wood sheets. It’s open to the public and there is a perpetual flow of customers, forklifts and elevating platforms.

The company opened 4 years ago, there is a good ethernet infrastructure at every cashier desk and aisle station, but the wireless gear was hard to spot.

Many PDAs and inventory scanners, forklifts. I did not take pictures of the handheld devices because the employees might have objected. Price tags on the shelves are low-tech.

I could not identify the devices that were hanging from the ceiling, some in a structured fashion, but pointed slantly across the aisles and not along it. Perhaps because the AP mount is not stable and the devices rotate freely.

This device is oriented across the aisle, not along it

Another orientation that does not make sense, probably it’s freely rotating due to air currents, thermal movements, machinery bumping it.

Definitely perpendicular to the aisles and shelves.

Some devices were just hanging from the ceiling or the fire extinguisher piping, like jungle vine.

Looks like they want to cover the whole area above the shelving

I recorded 97 BSSID with Airport Utility standing still near the cashiers. 92 BSSID were from a locally administered MAC OUI, 5 from universal OUIs. Here’s a list of the manufacturers:

00:A0:57 LANCOM LANCOM Systems GmbH
38:08:FD Silca Silca Spa
50:D4:F7 Tp-LinkT Tp-Link Technologies Co.,Ltd.
8C:34:FD HuaweiTe Huawei Technologies Co.,Ltd
02:18:4A Locally administered MAC address
02:18:5A Locally administered MAC address
E2:55:7D Locally administered MAC address

The BSSIDs where evenly spread on 2.4 Ghz and 5 Ghz. The SSID list, redacted for privacy:

(hidden SSID)
CLIENT
GUEST
PDA
SESWifi
Silca-Futura_XXXX
SMARTPHONE
TP-Link_XXXX
WebPocket-XXX

SES is a proprietary WPS solution from Cisco Linksys:

SecureEasySetup, or SES is a proprietary technology developed by Broadcom to easily set up wireless LANs with Wi-Fi Protected Access. A user presses a button on the wireless access point, then a button on the device to be set up (printer, etc.) and the wireless network is automatically set up. This technology has been succeeded by the industry-standard Wi-Fi Protected Setup.
https://en.wikipedia.org/wiki/SecureEasySetup

Silca Futura is a key cutting machinery manufacturer, so the SSID comes from the locks and safes area.

WebPocket is a 4G mobile wifi hostspot device made by Huawei.

Do you know what kind of devices/solution is behind the 92 local mac addresses? The comments are there for you.

Went to the hospital for a health check and spent the waiting time looking up to the ceiling. I spotted some RTLS devices from Centrak:

I did a quick scan with Airport Utility and found about 90 APs with hidden SSID and a Local mac address, plus other assorted OUIS. Here’s the OUI list:

02:18:4A Locally administered MAC address
02:18:5A Locally administered MAC address
00:A0:57 LANCOM Systems GmbH
38:08:FD Silca Spa
50:D4:F7 Tp-Link Technologies Co.,Ltd.
8C:34:FD Huawei Technologies Co.,Ltd

The locally administered Macs were broadcasting a hidden SSID, plus CLIENT, GUEST,PDA,SMARTPHONE.

The Silca OUI does not make sense here, unless it’s an access control system with intelligent door locks, the kind you operate with a keycard or a FOB.

Lancom Systems Gmbh is a network equipment manufacturer and solutions provider.

Channels in 2.4 Ghz are 1,6,11 as expected, and some 7 (what the heck?) and 9.

Channels in 5 Ghz: 36,44,64,104,112,140. Don’t know about channel width from the Airport Utility.