Re: Tutorial: Query the Apple database with Python for your access point BSSID

Marian wrote:
> Certainly that
> ability to change the BSSID of the access point exists in pro routers.
> 
> But what matters is not the router but the Wi-Fi chipset and the driver.

Drat.

We all agree the BSSID picked up by Apple/Google devices and then uploaded
to the Apple/Google WPS databases is simply the MAC address of the wireless
access point's radio interface as advertised in its beacon frames.

So to change the BSSID, we must change the MAC address of the AP interface.

While OpenWrt exposes:
  option macaddr 'AA:BB:CC:DD:EE:FF'
it is ultimately the driver and hardware that decide whether to honor the
override. Most modern Wi-Fi chipsets ignore it for AP mode.

Only older Atheros AR9xxx devices using the ath9k driver (circa 2008¡V2014)
allowed true MAC override in AP mode, which indirectly changed the BSSID.
These were fully mac80211-based radios with no firmware offload and no MAC
locking. Examples include early TP-Link WR841N/WR1043ND units and some
Ubiquiti M-series devices. These are now obsolete and unsuitable for modern
Wi-Fi.

Modern chipsets behave very differently. Qualcomm ath10k/ath11k, Mediatek
MT76 (MT7603/MT7612/MT7915/MT798x), and all Broadcom-chipset consumer
radios store the Wi-Fi MAC in OTP/EEPROM and enforce it in firmware. 

Even when OpenWrt accepts a user-specified MAC, the driver normalizes or
rejects it, or regenerates interface MACs from a fixed base. As a result,
the AP interface MAC cannot be changed, and the BSSID remains fixed.

From what I can determine, no modern consumer, prosumer, or WISP-grade
router (including Ubiquiti, MikroTik, OpenWrt, DD-WRT, or anything based on
Qualcomm, Mediatek, or Broadcom chipsets) can arbitrarily change the BSSID
that appears in beacon frames.

As far as I can find out in google searches, unfortunately for me, and for
anyone who cares about privacy, there is no mechanism in 802.11 to override
the BSSID field independently because the BSSID is not a configurable
parameter as the BSSID is always derived from the AP interface MAC address.

I wish it were that easy...