My router seems to be emitting a hidden network?

Question

I've recently installed Kali Linux to play with Wi-Fi networks in a lab enviroment within my own home. I initially tried to crack my own Wi-Fi but I have noticed something weird — there is a second network with an RSSI comparable to my actual Wi-Fi network. Is this due to my router being a dual-band router and the second network is actually its second band, and there is some magic that happens between the two bands making them act as a single network, or is there something else I don't understand going on here?

When I do airodump-ng against my wireless interface I see two entries with relatively high signal strength:

  BSSID   PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID
 [BSSID1] -56        7        0    0   1  54e. OPN              <length:  0>
 [BSSID2] -58       10       10    0   1  54e. WPA2 CCMP   PSK  [My Network's SSID]

The fact that the signal strength between the two is relatively close — much closer than any of the random neighbouring networks that are out of my control — leads me to believe they are originating from the same (and only) source I have in my house, which would be my dual-band router with 2 anttennas. Am I correct in my thinking? And if so, why & how does this second BSSID work?

Solution

If these were the main two BSSes of a simultaneous dual-band router, they would be on separate bands. If your airodump-ng output is reliable, these two BSSes are on the same band and channel: Channel 1, which is in 2.4GHz. 5GHz channels start at 36 and go up to 165.

Without knowing the BSSIDs, it's possible that these two BSSes are two "Virtual APs" (VAPs) on the 2.4GHz radio of your router. If they are both just VAPs on the same radio, the OUI of both BSSIDs should be TP-Link, or one or both of the BSSIDs should have the local bit set (the two's place bit of the first byte). If both BSSIDs have TP-Link OUIs and they're VAPs on the same radio, I'd expect them to be identical down to the last few bits of the BSSID (but that's not guaranteed).

If they both turn out to be coming from your router, it may not be anything to worry about. It may be that TP-Link has a scheme where they publish a second SSID for their setup app to find easily to help you get back into an AP when you know the admin password but messed up the network password. Or maybe the second SSID allows other TP-Link APs to know that this AP is capable of participating in a wireless extension/relay/mesh scheme. Still, it's worth figuring out exactly what it is.