BE88U: Remove hidden wireless networks?

[Viktor Jaep]

So it's been an Asus-specific WPA3 bug going on 3 years now? <sigh>

 

[visortgw]

So it's been an Asus-specific WPA3 bug going on 3 years now? <sigh>

Bug or implementation? It all depends on who you ask...

 

[Viktor Jaep]

Bug or implementation? It all depends on who you ask...

Guess it could be, but it seems messy. Maybe it's a workaround or something to help with compatibility.

 

[visortgw]

Guess it could be, but it seems messy. Maybe it's a workaround or something to help with compatibility.

The long, "random" hexadecimal SSID seems much too intentional.

 

[Ripshod]

If I run

nvram get apm1_ssid

On my RT-BE88U it returns the hex ssid. What is APM?
Try it on yours.
........ moment of deja vu.

 

[Tech9]

Must be something ASUS specific, can't tell bug or feature. As long as no one can connect there - not an issue. I tested a WPA3-only network on my UniFi setup and don't see related to it hidden network appearing. I know about other hidden networks in UniFi though not present with ASUS.

 

[Viktor Jaep]

From the Googles...

In the context of modern ASUS WiFi 6 and WiFi 7 routers, APM (often seen in NVRAM as apm1, apm2, etc.) stands for Action Plan Manager or Action Plan Mode. This is a backend system used to manage complex wireless features like AiMesh backhaul, Guest Network Pro, and IoT networks.

Why you see a random SSID
When you see a hidden or random-character SSID tied to an apm value, it is typically a dedicated backhaul or system-level network used for internal communication between nodes.

• AiMesh Backhaul: Newer routers use these SSIDs to create a "hidden" wireless link between a main router and its nodes. This is essential for maintaining a stable connection even if you haven't manually configured a wireless backhaul.
• WiFi 7 Multi-Link Operation (MLO): On WiFi 7 routers (like the RT-BE96U), apm values may be tied to the management of multiple frequency bands (2.4, 5, and 6 GHz) used simultaneously for a single connection.
• WPA3 Requirements: WiFi 7 and WPA3 strictly require certain management frames (PMF) to be active. The apm system ensures these security protocols are enforced on these hidden system networks to prevent unauthorized access to the mesh backbone.

Technical Context (NVRAM)

• apm1/apm2: These NVRAM variables store the "Action Plan" settings, which include the specific encryption (WPA3), SSID names, and radio power levels for these hidden system networks.
• Persistence: These SSIDs often reappear after a reboot or firmware update because the router's internal code (firmware) automatically recreates them in NVRAM if it detects they are missing, as they are considered "necessary behavior" for mesh functionality.

If you are not using AiMesh and find these SSIDs bothersome, they can sometimes be disabled by turning off AiMesh features or specific Smart Home/IoT master networks in the router's WebGUI.

 

[bennor]

That hidden WiFi network has been discussed before. In part or in whole its likely for AiMesh. Some past threads:

Asus XT9 Hidden Networks

Hi, I'm new here and also newbie with Asus routers. I have a trio of Asus XT9, one set as router and two as wired nodes. Everything is fine exept the fact that I see two Asus hidden networks. The nodes are set exclusively as wired, but I suspect that those hidden network have something to do...

www.snbforums.com

Any way to disable the ASUSTek Hidden Networks?

I am using various ASUS routers in AP mode since I gave up on Aimesh. I noticed all these AP's now have 5ghz hidden network broadcasting. I already went to each AP in the aimesh page and enabled ethernet backhual mode. but it appears to have not done anything. Does anyone know of a nvram...

www.snbforums.com

 

[Zamula]

I used a TamperMonkey script to unhide all hidden elements on the Wireless General page, and this is what it looks like. You could probably also use developer tools to unhide.

This is for the RT-BE92U.

 

[Tech9]

hidden elements

Most hidden elements are hidden because don't apply to the specific model router though.

 

[KevTech]

I used a TamperMonkey script to unhide all hidden elements on the Wireless General page

You can accomplish the same thing by just viewing the page with no style.

 

[Shonk]

Its a hidden ssid not "strange ssid" also the mac address is the same as the main ssid but one digit off xx:xx:xx:xx:xa vs xx:xx:xx:xx:xb for example

 

[mmjlmjl]

This feature is related to using WPA2/WPA3 mixed mode. Setting it to WPA3 or WPA2 only the phantom ssid disapears

 

[Ripshod]

This feature is related to using WPA2/WPA3 mixed mode. Setting it to WPA3 or WPA2 only the phantom ssid disapears

Not on the RT-BE88U running Merlin.

 

[Ripshod]

And just to round things of (for me) I'm currently connected to the hidden network (details from nvram) and everything network and internet is running just fine for me.

 

[table45]

I have seen the same thing both on tuf-be3600 and rt-be86u on the latest Asus firmware as of the date of this post. I sort of have an answer.

Tl;dr - it’s WDS, not aimesh or wpa3 etc.

What I see is beacons being broadcast on both 2.4ghz and 5ghz with an empty SSID (“hidden” SSID), with a source MAC address one lower than the router’s main MAC for that network. They DON’T stop after a while, and they are every 100ms as per the default beacon interval. The beacon is large (about 500 bytes) and these 5ghz beacons are transmitted at 6mbits…

I haven’t touched or used aimesh.

But what I discovered is the MAC addresses match those under the WDS tab. The default settings there are “AP only”. If I change this to “WDS only” the mystery beacons stop! (But it breaks a lot of other stuff lol so do NOT do this).

There is no “Disable” option when there really should be, to avoid unnecessary beaconing.

 

[i0ntempest]

I have seen the same thing both on tuf-be3600 and rt-be86u on the latest Asus firmware as of the date of this post. I sort of have an answer.

Tl;dr - it’s WDS, not aimesh or wpa3 etc.

What I see is beacons being broadcast on both 2.4ghz and 5ghz with an empty SSID (“hidden” SSID), with a source MAC address one lower than the router’s main MAC for that network. They DON’T stop after a while, and they are every 100ms as per the default beacon interval. The beacon is large (about 500 bytes) and these 5ghz beacons are transmitted at 6mbits…

I haven’t touched or used aimesh.

But what I discovered is the MAC addresses match those under the WDS tab. The default settings there are “AP only”. If I change this to “WDS only” the mystery beacons stop! (But it breaks a lot of other stuff lol so do NOT do this).

There is no “Disable” option when there really should be, to avoid unnecessary beaconing.

Exactly what other stuff does changing to “WDS Only” break? I’m tempted to try this, iirc WDS is related to repeaters and I don’t have repeaters.

 

[table45]

Exactly what other stuff does changing to “WDS Only” break? I’m tempted to try this, iirc WDS is related to repeaters and I don’t have repeaters.

Throughput tests would start out well but then collapse to about 1/4 of normal. Really weird traffic patterns while sniffing with wireshark. It did something weird switching to channel 36 even though I had it hard set to 100, and there were weird things I didn't have time to double check so don't really want to say them out loud (eg. I think I ended up a mix of different channels in use, and one device ended up with an internal IP address in an IP range I don't use but like I said I didn't pay close attention to these, I needed it back before my family killed me).

 

[Smedley]

I have seen the same thing both on tuf-be3600 and rt-be86u on the latest Asus firmware as of the date of this post. I sort of have an answer.

Tl;dr - it’s WDS, not aimesh or wpa3 etc.

What I see is beacons being broadcast on both 2.4ghz and 5ghz with an empty SSID (“hidden” SSID), with a source MAC address one lower than the router’s main MAC for that network. They DON’T stop after a while, and they are every 100ms as per the default beacon interval. The beacon is large (about 500 bytes) and these 5ghz beacons are transmitted at 6mbits…

I haven’t touched or used aimesh.

But what I discovered is the MAC addresses match those under the WDS tab. The default settings there are “AP only”. If I change this to “WDS only” the mystery beacons stop! (But it breaks a lot of other stuff lol so do NOT do this).

There is no “Disable” option when there really should be, to avoid unnecessary beaconing.

Excellent detective work! Thanks for the follow-up! I too am curious as to what other stuff breaks when set to "WDS only" rather than "AP only".

 

[table45]

Excellent detective work! Thanks for the follow-up! I too am curious as to what other stuff breaks when set to "WDS only" rather than "AP only".

I replied to that question above

Since then I've realised the mac address in question is actually the base Mac address of the 2.4 and 5 Ghz interfaces, it's not just a specific WDS address. Anyway I don't think I've actually helped because I don't have a solution that makes it go away that doesn't break things...

Wifi is annoyingly messy and/or complex/the wild west. Its a miracle we don't have more issues than we already do.

eg. I have WMM APSD enabled as per default on my rt-be86u. But the beacons from the router say its off...

Also eg. all online documentation says to use a DTIM of 3 (and indeed it's the default on many routers) because "its what Apple likes, and it means devices only have to wake up and check every 3rd beacon". But my iPhone just ignores the DTIM setting, no matter if its 1 or 3 it tells the router its only going to wake up to check the beacon every 20 beacons (2 seconds) - as the listen interval in Association Requests is 0x0014. 3 doesn't divide into 20 nicely so my theory is a DTIM of 1 may be better... And DTIM is for broadcast traffic only anyway, which includes stuff like mDNS/Bonjour etc.