A network failure at a production facility was caused by an unauthorized DHCP server. Network administrators identified the device using Advanced IP Scanner, which reported a Ubiquiti MAC address. However, physical inspection revealed a Cisco access point, while the web interface belonged to a TP-Link router.
The investigation revealed that the TP-Link router was connected to the main network via a Ubiquiti wireless bridge. In the absence of WDS (Wireless Distribution System) mode, the bridge performed L2 NAT, replacing the MAC addresses of all client devices with its own. This caused the network equipment to misidentify the TP-Link router as a Ubiquiti device.
The IEEE 802.11 standard uses a 3-address frame format for Wi-Fi, which is insufficient for transparent bridging that requires four addresses: the source, the destination, and both bridge nodes. While the 802.11 specification allows for a 4-address frame using specific flags, it does not define the implementation logic for bridging.
Compatibility issues arise because manufacturers implement 4-address frame handling differently. Devices using open-source Linux drivers can generally interoperate in WDS mode. Conversely, proprietary drivers from vendors like Broadcom or Realtek use closed-source stacks, making them incompatible with standard Linux-based bridging and other vendors' hardware.
Building a vendor-neutral transparent bridge is further complicated by Wi-Fi security standards. Protocols like WPA and WPA2 are designed for a hierarchical infrastructure mode, which does not natively support the peer-to-peer nature of transparent bridging between different hardware vendors.
