If you have done any wifi base station analysis, or used passive wireless analysis tools like wavemon or Kismet to monitor your local RF environment, you may have spotted a persistent, unidentified hidden Wi-Fi network broadcasting on the exact same channel and frequency as your primary access points.

The mystery access point typically broadcasts an encrypted hidden beacon with an unrecognizable MAC address prefix like 62:45:b8:.... It doesn’t match known vendor OUIs in IEEE databases, and it frequently triggers “Rogue AP” alerts on managed access points.

After isolating devices in my home lab using a dedicated Raspberry Pi 4 wireless monitoring node (pi4mon), I traced this ghost BSSID directly to an Amazon Echo Dot 5th gen.

More importantly: it continues broadcasting even when Amazon Sidewalk is completely disabled.

Here is how to track down this hidden station, why the MAC address looks spoofed, what Amazon’s firmware is actually doing under the hood, and how to manage it cleanly on your network.

The Discovery: Sniffing Mystery 5 GHz Beacons

While testing wireless monitoring on a Raspberry Pi 4 equipped with a secondary monitor-mode USB Wi-Fi adapter (rtw88_8822bu) and Kismet, two unmapped hidden 5 GHz BSSIDs kept showing up with strong signal levels:

  • 62:45:b8:ec:07:a7 (-46 dBm, ESS Privacy, Channel 149)
  • 62:45:b8:7c:b9:7e (-72 dBm, ESS Privacy, Channel 149)

In an environment with TP-Link Omada EAP723 access points where wireless mesh was disabled at the site level, a hidden AP transmitting beacon frames every 100 Time Units (~10 beacons per second) demanded investigation.

To isolate the transmitter, I methodically powered down potential culprits:

  1. Omada Mesh: Already disabled in the controller; APs remained on static channels.
  2. Wireless Printer: Brother HL-L2350DW powered off; both beacons remained active.
  3. Fire TV Stick: Unplugged; both beacons remained active.
  4. Amazon Echo Dot: Unplugged from wall power.

Within 30 seconds of cutting power to the Echo Dot, 62:45:b8:ec:07:a7 vanished entirely from iw dev wlan1 scan. Plugging the Echo back in immediately restored the hidden beacon on the same channel.

BSS 62:45:b8:ec:07:a7(on wlan1)
        TSF: 104829144400 usec (1d, 05:07:09)
        freq: 5745
        beacon interval: 100 TUs
        capability: ESS Privacy SpectrumMgmt ShortSlotTime (0x0131)
        SSID: 
        Supported rates: 6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 
        RSN:     * Version: 1
                 * Group cipher: CCMP
                 * Pairwise ciphers: CCMP
                 * Authentication suites: PSK

How to Scan for Hidden BSSIDs and the 62:45:b8 Prefix on Linux

To check your own environment, you can use standard Linux wireless utilities:

# 1. Target the specific 62:45:b8 prefix with context (signal, freq, SSID)
sudo iw dev wlan1 scan | grep -E -B 1 -A 10 "^BSS 62:45:b8"

# 2. Faster scan locked to a specific frequency (e.g. Channel 149 / 5745 MHz)
sudo iw dev wlan1 scan freq 5745 | grep -A 8 "62:45:b8"

# 3. Pull all hidden BSSIDs across all channels with signal strengths
sudo iw dev wlan1 scan | awk '
  /^BSS / { bss=$2; sub(/\(.*\)/, "", bss) }
  /freq:/ { freq=$2 }
  /signal:/ { sig=$2 " " $3 }
  /SSID: *$/ { print bss, "Freq:" freq, "Signal:" sig, "[HIDDEN]" }
'

# 4. Using NetworkManager (nmcli) — hidden networks display as '--'
nmcli -f BSSID,SSID,CHAN,FREQ,SIGNAL,SECURITY dev wifi list | grep -E "(--|62:45:B8)"

Decoding the 62:45:b8 MAC Address

If you search IEEE OUI databases for 62:45:b8, you get zero hits. This is because Amazon’s firmware uses a locally administered MAC address.

In standard IEEE 802 addressing, the second-least-significant bit of the first octet (the U/L bit) dictates how the address was assigned:

  • 0: Universally Administered (burned into hardware by the vendor with an assigned OUI).
  • 1: Locally Administered (generated dynamically in software or virtualized).

When the U/L bit is set, the second hexadecimal digit of the first byte must be 2, 6, A, or E.

Hardware OUI: 60:45:b8 (Amazon Technologies Inc.)
Binary:       01100000 : 01000101 : 10111000
                    ^-- U/L bit is 0 (Universal)

Virtual SoftAP: 62:45:b8
Binary:         01100010 : 01000101 : 10111000
                    ^-- U/L bit is 1 (Locally Administered)

Amazon’s Wi-Fi driver takes the Echo’s factory physical MAC (60:45:b8), flips the U/L bit to make it 62:45:b8, and spins up a secondary virtual SoftAP / Wi-Fi Direct interface alongside its client connection to your router.

Why Disabling Amazon Sidewalk Doesn’t Stop It

When users discover their Echo broadcasting ad-hoc signals, the most common assumption is that Amazon Sidewalk is responsible.

Many users deliberately opt out of Amazon Sidewalk in the Alexa app under Account Settings → Amazon Sidewalk to prevent bandwidth sharing. However, disabling Sidewalk will not stop the hidden Wi-Fi beacon.

As documented in the Amazon Sidewalk Protocol Specification, Sidewalk operates exclusively over two physical radio layers:

  1. Bluetooth Low Energy (BLE) (2.4 GHz)
  2. Sub-GHz FSK / LoRa (900 MHz)

Sidewalk does not communicate over 802.11 Wi-Fi. Turning Sidewalk off shuts down the 900 MHz and BLE community mesh bridging, but leaves the Echo’s Wi-Fi driver and its virtual SoftAP completely untouched.

What Is the Hidden Wi-Fi Station Doing?

Amazon’s consumer documentation never mentions this virtual AP because it lives inside the device’s proprietary Linux/Android wireless subsystem. Based on Amazon patent filings and developer documentation, the hidden station serves three local peer-to-peer functions:

  1. Frustration-Free Setup (FFS) / Wi-Fi Simple Setup (WSS):
    When you bring a new Amazon-compatible smart plug, bulb, or accessory home, an existing Echo acts as an ambient Wi-Fi Provisioner. The Echo uses this secondary interface to discover unconfigured devices and securely push your stored Wi-Fi credentials over the air—without requiring you to manually switch your smartphone’s Wi-Fi network.
  2. Echo Spatial Perception (ESP):
    When you say the wake word in a room with multiple Echo units, the devices coordinate over local peer links to arbitrate which microphone array picked up the clearest audio before responding.
  3. Alexa Home Theater & Stereo Pairing:
    When paired with a Fire TV stick or a second Echo for stereo audio, the devices establish a direct, low-latency 802.11 Wi-Fi Direct link to synchronize audio streams without routing traffic through your home router.

Can You Turn It Off?

In short: No.

Amazon provides no toggle in the Alexa mobile app, no hidden web interface, and no API command to disable the virtual SoftAP.

Even if you delete all saved Wi-Fi credentials from your Amazon Cloud locker (Manage Your Content and Devices → Preferences → Saved Wi-Fi Passwords), the Echo firmware keeps the virtual SoftAP beaconing as long as the device has an active Wi-Fi connection.

Best Practices for Network Engineers & Home Labs

While the hidden beacon consumes minimal airtime (~0.1% to 0.3% channel utilization) and uses WPA2/WPA3 encryption, it can still complicate spectrum planning and trip security alarms.

Here is the cleanest way to handle Echo devices on a structured network:

1. Confine Echos to a Dedicated 2.4 GHz IoT SSID / VLAN

The Echo Dot contains a single physical Wi-Fi radio that time-slices between its client connection (wlan0) and its virtual SoftAP (p2p0/ap0).

Because both virtual interfaces must operate on the same physical radio, the hidden SoftAP will always broadcast on whatever Wi-Fi channel the Echo connects to.

  • If you connect your Echo to your 5 GHz high-speed network, it broadcasts a hidden 5 GHz beacon right in the middle of your performance spectrum (e.g., Channel 149).
  • If you assign your Echo devices to an isolated 2.4 GHz IoT SSID pinned to Channel 1, 6, or 11, the hidden beacon is forced onto 2.4 GHz, keeping your 5 GHz and 6 GHz spectrum clean and unpolluted.

2. Whitelist the MAC Prefix in Your Wireless Controller

If your UniFi, Omada, Aruba, or Meraki controller flags the Echo’s hidden network as a “Rogue AP” or “Ad-hoc Network,” look up your Echo’s primary MAC address in your DHCP leases.

Flip the U/L bit (typically turning 60: into 62:) and add that locally administered MAC prefix to your controller’s Rogue AP whitelist to eliminate recurring false-positive security alerts.

Bottom Line and Next Steps

If you see an encrypted, hidden Wi-Fi network running on the same channel as your home router with a 62:45:b8 MAC address, your network has not been compromised. It is your Amazon Echo running a background SoftAP for automated provisioning and audio synchronization—and disabling Amazon Sidewalk will not turn it off.

I’ve reported this issue to Amazon frontline customer support, but they naturally weren’t familiar with the hidden SSID. They’ve committed to escalating the ticket and hopefully we will get an option to turn off this unwanted network in the future.