1

I am the network admin of a small company. We have a rogue wireless access point broadcasting our SSID that's not connected to the network. Occasionally, the Macs in the area will attach to this AP and will then have no network access.

I have identified the MAC address of this WAP/device.

Is there a way to blacklist the MAC address of this specific AP so that the Mac workstations/laptops don't try to use for network access?

(Fair warning, I'm a Windows guy, so please provide instructions a 5-year old can understand :-) )

Thanks in advance!

  • If it your wireless access point - turn it off. – Mark Jun 26 at 18:04
  • This is a simple XY problem - find the physical rogue access point instead of locking it out. You might want to rethink your SSID scheme as well. How many non-rogue access points do you have in service? – IconDaemon Jun 26 at 18:24
  • Banning a MAC address is usually done at the network level, on your switches, routers, firewalls, etc. It may be possible on individual computers but trying to do that on a bunch of computers is a snipe hunt. Again find a network guy who can help you with this. – Steve Chambers Jun 26 at 18:33
  • I believe the rouge AP is someone's phone in Hotspot mode and they're broadcasting our SSID as the signal strength varies. If I knew where it was, I'd definitely turn it off, but I don't, so I'm looking for a solution at the desktop-level. The AP isn't on the network, so I can't ban it at the network level, hence me asking about how to do it on the desktop. There are utilities that can do this in Windows; what are my options in OS X (10.14.x)? – JSM Jun 27 at 4:05
1

Unfortunately macOS does not provide a way to blacklist a specific access point. On some other operating system you can do this via the BSSID (basic service set identifier) of the access point.

You were referring to a MAC, but it is not really a MAC - but rather a BSSID. The BSSID is usually derived from the actual MAC of the access point though, but it is not the same.

I would look at two ways to solve the problem:

The first would be to try and find the rogue access point by connecting to your Macs remotely and issuing the following command:

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s

This command gives you a list of the access points in range - including the BSSID. If you automate this command to be run on all computers, you should be able to narrow down which computers can detect that access point, and with which signal strength. Hopefully this will allow you to find the rogue access point.

The second way to try and solve the problem is to work the other way around - namely by specifying which access point your desktops connect to. I.e. do not block a specific access point, but instead specify which to connect to (a kind of white list).

You can connect to a specific access point using this command:

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport --associate=<SSID> --bssid=<BSSID>

You must replace "" and "" with their corresponding values.

If you have multiple access points of your own, you'll need to create a small scirpt to select the known-good BSSID with the best signal strength obtained from running the previously mentioned command.

There's also a third party utility that supposedly makes it easier to associate to a specific access point:

https://github.com/qpSHiNqp/airport-bssid

However it seems it hasn't been updated since 2016, so it might be out of date.

It is used like this:

airport-bssid <interface> <bssid> <password>

where you need to replace , and accordingly. Interface could be for example "en1".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .