Hiding a wireless network name, or SSID, is a popular method for enhancing the basic security of a home or office infrastructure. Many administrators believe that if a network is invisible to casual passersby, it is inaccessible to attackers. However, in the world of networking, visibility and accessibility are different concepts, and a full understanding of the process requires detailed consideration.
Routers Mikrotik Provide flexible tools for managing your wireless space, allowing you to not only hide your network name but also configure complex filtering rules. In this article, we'll explore the technical aspects of hiding your SSID, explain how it works at the protocol level, and provide step-by-step instructions for implementing this configuration using the utility. WinBox.
It's worth noting that network obfuscation doesn't replace the use of strong passwords and modern encryption protocols. It's just one layer of protection that can reduce noise in the air and hide your infrastructure from prying eyes, but it doesn't make it invulnerable. We'll cover the setup process in detail below.
The concept of hidden SSID and security
When you hide the SSID, the access point stops broadcasting the network name in broadcast frames. Beacon FrameWhen scanning the airwaves, regular devices don't see this network in the list of available connections. However, this doesn't mean the traffic has disappeared or become invisible to specialized equipment.
Security experts often call this approach "foolproof," as a skilled attacker can easily detect a hidden network by analyzing the traffic of connected clients. When your smartphone or laptop attempts to reconnect, it automatically sends out requests with the network name, making it visible to sniffers.
⚠️ Note: Hiding the SSID is not a complete security measure. Be sure to use an encryption protocol. WPA2/WPA3 and complex passwords, since hiding the network name is easily bypassed.
However, for home or small office use, hiding the network helps reduce visual noise in the list of available Wi-Fi networks on guests' and neighbors' devices. It also prevents automatic connection attempts by other devices that may have previously registered a network with a similar name.
It is important to understand that 802.11 protocol The network wasn't originally designed to be completely hidden, so working with hidden networks may have its own compatibility issues with some older IoT devices or printers. Modern devices usually connect without issue if the settings are configured correctly.
Preparing for setup via WinBox
Before making any changes to your router's configuration, ensure a stable connection to the device. Since we'll be changing wireless network settings, there's a risk of losing the connection if you configure the settings incorrectly. Therefore, it's recommended to perform the initial setup while standing close to the router.
To work you will need a utility WinBox, which can be downloaded from the manufacturer's official website. This is a native management tool. Mikrotik RouterOS, providing access to all necessary menus. Alternatively, you can use the web interface, but WinBox is more stable and faster.
☑️ Preparing to set up Mikrotik
Before starting work, it is strongly recommended to create a backup of the current configuration. In the event of an error, you can quickly restore the network to working order. To do this, go to the menu WinBox go to the section Files and press the button Backup.
Make sure your management device (laptop or PC) has a static IP address or a reserved address in DHCP to avoid losing connection to the router during your experiments. Also, check that the version RouterOS This is relevant because older versions may have had vulnerabilities in the wireless module.
Step-by-step instructions: Disabling SSID broadcasting
The process of hiding the network in Mikrotik It's quite simple and can be done through a graphical interface. Open WinBox, log in and select a section in the menu on the left Wireless. You will see a list of wireless interfaces, usually designated as wlan1, wlan2 or similar names.
Double-click the desired interface to open its properties window. Find the tab WirelessThis is where the main parameters of the radio module are located. In the list of settings, find the field called Hide SSID. By default it is not active.
Activate the checkbox Hide SSID. After that, click the button Apply And OKFrom this point on, the router will stop sending packets with your network name. Devices that were previously connected may lose connection and will need to be reconnected manually, specifying the network name.
/interface wireless set [find] hide-ssid=yesThe same operation can be performed via the terminal, which is especially convenient for remote administration or batch configuration of multiple devices. The above command will apply the setting to all wireless interfaces. If there is only one interface, the command will work correctly.
⚠️ Note: After enabling this option, all connected devices may disconnect. You will have to re-enter the network name (SSID) and password on each device manually, as automatic search will no longer work.
Setting up security and encryption profiles
Hiding the SSID is only half the battle. It's crucial to configure the security profile correctly. In the wireless interface properties window, go to the tab Security ProfileHere you can create a new profile or edit an existing one, for example, default.
In the profile settings, make sure that the mode is selected WPA2 PSK or, if the equipment supports it, WPA3Using outdated encryption WEP or open network (none) makes hiding the SSID practically useless, since the traffic can be easily intercepted and decrypted.
Pay attention to the field WPA2 Pre-Shared KeyThis is your WiFi password. It should be complex and contain mixed-case letters, numbers, and special characters. The password should be at least 12 characters long to ensure resistance to brute-force attacks.
| Parameter | Recommended value | Description |
|---|---|---|
| Authentication Types | wpa2-psk, wpa3-psk | Authorization types, choose the most modern ones |
| Group Encryption | aes-ccm | Group traffic encryption algorithm |
| Unicast Encryption | aes-ccm | Individual traffic encryption algorithm |
| WPA2 Pre-Shared Key | Complex password | Network access key |
After setting up the profile, be sure to apply the changes. In some cases, you may need to reboot the wireless interface for the new security rules to take effect. This can be done by clicking the button Disable, and then Enable in the window Wireless.
Connecting client devices to a hidden network
Once a network is hidden, the process for connecting new devices changes. The operating system won't be able to simply select the network from the list. You'll have to manually create a new connection profile.
In Windows, when connecting to a new network, select the "Hidden Network" option or enter the network name (SSID) manually. Careful entry is important: the letter case must match exactly. If you make even one mistake, the connection will fail.
- 📱 Android: Go to WiFi settings, select "Add network", enter the exact network name (SSID), select the security type (usually WPA/WPA2-Personal) and enter the password.
- 🍏 iOS: In the WiFi section, select "Other...", enter the network name, select the security type, and enter the password. Make sure the "Hidden network" toggle is enabled.
- 💻 macOS: In the WiFi menu, select "Other..." and enter the network name and password. The system will automatically detect the security type, but it's best to check it manually.
- 🖥️ Linux: In NetworkManager, select "Connect to Hidden Network", enter the SSID and authentication data.
There's a caveat with some "smart" devices, such as lamps, sockets, or old printers. They often lack a proper interface for entering a hidden SSID. In such cases, you'll have to temporarily enable SSID broadcasting on the router, connect the device, and then hide the network again.
Problems with roaming
When using multiple Mikrotik routers in repeater or mesh mode, hiding the SSID may disrupt fast roaming between access points. Devices may take longer to lock onto a distant access point.
Diagnosing and troubleshooting connection problems
Sometimes, after hiding a network, devices stop connecting or become unstable. This may be due to issues with wireless card drivers. Some network adapters aggressively scan the airwaves and may ignore networks that don't respond to broadcast requests in the standard manner.
Check the router logs in the section LogIf you see association messages, but then a disconnection occurs, the problem may be in security settings or incompatibility of operating modes (for example, mixing modes 802.11b/g/n). Try to fix the operating mode, for example, only 802.11n or 802.11ac.
It's also worth checking if MAC address filtering is enabled, which may conflict with the new settings. In the menu Wireless there is a tab Access ListMake sure your devices aren't accidentally locked there.
⚠️ Note: The interface and menu layout may differ slightly depending on the version RouterOS (v6 or v7). In the seventh version of Mikrotik, some wireless module parameters were reworked for better compatibility with standards.
If the problem persists, try creating a new one Security Profile from scratch, rather than editing the existing one. Sometimes cached data or conflicting settings may remain in the profile, which can interfere with normal operation after changing visibility settings.
Impact of hidden network on performance
There's a myth that hiding the SSID significantly improves network speed. In practice, the impact on throughput is minimal. However, there's a caveat related to service traffic.
When the SSID is hidden, client devices are forced to send more frequently Probe Request "Find Me" request packets to check for network availability. This creates additional overhead traffic, which in densely populated areas can even slightly reduce the overall efficiency of the radio channel.
Additionally, some devices in power-saving mode may perform worse with hidden networks, as they have to wake up more frequently to search for a base station. This can lead to faster battery drain on mobile devices.
Is it possible to restore network access if I forgot the hidden SSID name?
Yes, if you have physical access to the router. Connect to it via a LAN cable and log in via WinBox or the web interface. In the menu Wireless Double click on the interface and you will see the field SSID, where the network name is listed. If you forgot your password, you can view or reset it in your security profile.
Will my neighbors see my hidden network using WiFi analysis software?
Yes, programs like WiFi Analyzer or Aircrack-ng They see hidden networks. They're displayed as "Hidden Network" or simply by MAC address (BSSID). Furthermore, as soon as your device attempts to connect, the network name will appear in the logs of such programs.
Will hiding the SSID reset the guest network settings?
No, the guest network (if implemented via a separate virtual AP interface) is configured independently. However, if you apply settings globally to the radio card, make sure you are editing the correct interface. In Mikrotik, each SSID is a separate interface in the list. Wireless.
Does WPS work with a hidden network on Mikrotik?
Mikrotik equipment has limited support for WPS (Wi-Fi Protected Setup) and is often disabled by default for security reasons. Even if enabled, connecting to a hidden network via WPS may be impossible or require physically pressing the button on the router at a specific time.