Broadcasting the same MAC and ESSID as another AP - questions

[devilsson2010]

This was asked in another thread, but that person seemed to be using it illegally instead of for learning purposes. But again, if I were to broadcast the same MAC and ESSID as my access point, except at a much stronger signal, what will happen?

As in:
- Will someone pick up both or just the stronger one
- Will everyone connected to the access point be redirected to the re-broadcasted signal
- Anything else bad that could come from this


I'm going to try this now on Windows, since I only have 1 network card compatible with BT3.

[aggtrfrad]

- Will someone pick up both or just the stronger one

since both APs broadcast exactly the same packet, the client would see only one AP (Thats not always true, I think there is channel hoping involved, and it depends on what drivers/software the client is running)

- Will everyone connected to the access point be redirected to the re-broadcasted signal

It doesn't work like that. The client knows if it is connected to it's AP, by sending probe requests every few seconds, and the AP has to reply to this requests. You said that you are changing both the bssid and essid, that's all the client has, to identify the master AP. Now, if you set the rogue AP to respond to clients probe requests, then the client will take 2 probe responses on each probe request, but this will probably not affect anything...
If you set up routing on the rogue AP, and you reply to the clients packets, then the client will accept as the real packets, the ones that come first, and ignore the rest ones (again, it depends... there are always exceptions), see Airpwn

[devilsson2010]

Thanks, I'm going to look at airpwn now.

[Thorn]

Google for up "Evil Twin". This has been covered ad nausem.