Wi-Fi

Association, security type and network identity.

A wireless network is trusted at the moment it is joined and then rarely reconsidered. What it looks like today may not be what it looked like when you decided to trust it.

What GURDN observes

The associated network and its name.
The security type in use, for example whether the association is open or encrypted.
How both compare with previous associations GURDN recorded for the same network.

Wireless security changes are not notified by Windows, so they are found by polling.

Network identity

Networks are fingerprinted from the interface kind, the wireless network name, the gateway address and the gateway hardware address read from the neighbour table. A name alone is worthless for identity: anyone can broadcast a network with the same name as your home or office.

Where the gateway address cannot be resolved, the fingerprint rests only on signals a nearby attacker can forge. GURDN reports the identity as weak rather than claiming it recognised the network. A product that says it recognised a network when it only recognised a name is giving away exactly the reassurance an attacker wants it to give.

Why a changed security type matters

A network that was encrypted last week and is open today, with the same name, in the same place, is a fact worth putting in front of a person. GURDN reports it alongside whatever else changed at the same moment rather than as an isolated alert. See network observation.

Wi-Fi is observation only

GURDN does not join, leave, forget or reconfigure wireless networks. It reports what the machine is associated with and how that compares with before.