5

I have two WLAN SSIDs. One is operating at 2.4GHz frequency, and the SSID is "stratus24". Other is operating at 5GHz frequency, and the SSID is "stratus50". Both of these WLANs are bridged to the same Ethernet LAN. So, there are three ways to access the same network: via "stratus24" SSID at 2.4GHz, via "stratus50" SSID at 5GHz and via an Ethernet cable.

Now, if I connect my laptop (that has been previously connected to both stratus24 and stratus50 WLANs) via an Ethernet cable to the LAN, Windows 10 decides that the name of the wired network is "stratus24".

How does Windows 10 decide that the network is "stratus24"? Is it using the MAC address of the default router? Or the MAC address of the DHCP server? Both the DHCP server and the default router happen to be one and the same device, but that may not always be true.

An image of simultaneous 5GHz WLAN connection ("stratus50") and a LAN connection (which Windows 10 for some reason decides to be "stratus24"):

enter image description here

6
  • Where is this network name appearing? Please add a screen-shot to your question to make it clear where the name is being displayed. I have a Win10 machine with only Ethernet, and this is the connection label. – AFH Apr 23 '18 at 15:06
  • 1
    This is usually a function of the router, not Windows. Since the majority of devices still connect on the 2.4ghz band, whatever you name that for the SSID tends to be the network "name". It's basically a default. – CDove Apr 23 '18 at 15:17
  • 1
    @CDove I just performed ipconfig /renew and all I can see are DHCP options 53 (msgtype), 54 (srvid), 51 (lease time), 58 (renewal time), 59 (rebinding time), 1 (subnet mask), 28 (broadcast address), 3 (router), 6 (DNS server), 15 (domain name), 81 (client FQDN) and 255 (end). The domain name is "lan", not "stratus24". So, my Wireshark indicates it can't be DHCP that's conveying the "stratus24" string. What do you suggest, what protocol could it be? My belief is still that Windows has some kind of MAC address to SSID database... – juhist Apr 23 '18 at 15:26
  • @juhist - You could be right: I thought that the LAN and wireless bands had different MAC addresses, but on checking my router I find that the LAN and 2.4GHz wireless have the same MAC. I'll try some experiments later, but I'm going out shortly, so it will be tomorrow before I can report any results. – AFH Apr 23 '18 at 15:55
  • 1
    Oh! I tested DHCP server MAC in 5GHz Wi-Fi network by using Wireshark, and it uses the :17 MAC, that is the Ethernet MAC. The Wireless MACs are not used for the DHCP server because the wireless networks are in a bridged mode. So it could be DHCP server MAC address based. – juhist Apr 23 '18 at 16:07
5

I think I found the reason. I searched for "stratus24" in Windows registry using regedit and found that Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{41FBD081-E721-466D-89F9-2FE1FB37FEB6} has in ProfileName the "stratus24" string.

So, the next thing was to search for 41FBD081-E721-466D-89F9-2FE1FB37FEB6. I found it in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged\01(string shortened)05. It has ProfileGuid set to {41FBD081-E721-466D-89F9-2FE1FB37FEB6} and the DefaultGatewayMac is set to the MAC address of my default gateway!

Note the very long string after Signatures\Unmanaged\ was shortened because I'm not certain if it has my Wi-Fi password in an encoded form.

Based on this registry search, Windows is indeed using the default gateway MAC address to decide the name of the wired network. In my case, due to bridged operation of the WLAN device, the router bridges all networks (2.4GHz, 5GHz, Ethernet) together and the default gateway in all networks has the same MAC address.

Apparently, the fact that it selected "stratus24" and not "stratus50" was due to some random event, such as me connecting to the 2.4GHz network first before connecting to the 5GHz network, and now the profiles are forever in the order where the "stratus24" name is found before the "stratus50" name is found.

I do find a link in another directory (or whatever these things are called in Windows registry) in the registry to the "stratus50" string using the exact same default gateway MAC address. But apparently Windows finds the "stratus24" string first before finding the "stratus50" string.

5
  • I have done some tests, with equally confusing results. My router's WiFi is WEP, as I have legacy devices to support, but one of the Win10 updates stopped this working, so for Win10 I now use a power-line access point running WPA with a different SSID. However, the Ethernet connection shows the router's SSID, presumably remembered from when it used to work. I have a newish laptop which has only ever connected to the AP, but it has no Ethernet port! The desktop with the correct Ethernet label doesn't have a wireless connection, so it doesn't know the router's SSID. Maybe I'll try a WiFi dongle. – AFH Apr 23 '18 at 23:13
  • I tried a WiFi dongle. Curiouser and curiouser. Again I needed to use an AP running WPA, and suddenly Ethernet became the SSID of the AP (not the SSID of the router), and it persists after removing the dongle. But here's the real puzzler: the AP's SSID isn't anywhere in the registry! In Control Panel -> Network Connections, the SP's SSID appears as the status, where it was previously Enabled. I haven't a clue what is going on: the SSID must be somewhere, but I don't know where to start looking. – AFH Apr 24 '18 at 21:19
  • After restarting I found the AP's SSID in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{ID string}\ProfileName. I patched this back to Ethernet and the description was restored after another restart. I also found the SSID string in one other place, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings\Network\Preferences\SelectedWiFiProfile, but I left this alone. – AFH Apr 28 '18 at 16:06
  • In my case, when I looked for the {ID string} I found it was attached to my network printer! Bizarre. – AFH Apr 28 '18 at 16:22
  • 1
    This is very interesting. I'd always thought that declaring a name for the wired network was a standard DHCP feature rather than a Windows client-side trick to make networks more identifiable. – Manchineel Feb 9 '20 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.