When I use a wifi hotspot, sometimes I can't use sudo arp-scan -l to see other devices (except the hotspot), but sometimes I can see another laptop, but I never see another android phone. (The hotspot is borrowed from a public library, and the first hotspot I have ever used, so I don't know about it but guess its model is Alcatel Mw41 based on its appearance.)

When I use a router, most always I can see the other two devices (sometimes not).

I was wondering if a hotspot works differently, or arp-scan doesn't work sometimes?


  • Is the connection encrypted (WPA, WPA2)? If yes, you won't see other devices, unless they broadcast or multicast, because all communication is between each client and the AP.
    – dirkt
    Commented Mar 10, 2019 at 20:43
  • Thanks. Both wifi networks are WPA2. But I can see other devices in the router's wifi, not in the hotspot's wifi.
    – Tim
    Commented Mar 11, 2019 at 0:09

1 Answer 1


In several implementations of wireless APs either domestic or enterprise, you can choose whether or not you allow clients talking with each other.

If that security measure is enabled, the clients will be only able to talk with the AP/the outside networks, but not with other clients under the same network/AP/controller.

From the top of my head, as examples, OpenWRT, Cisco and Meru allow to configure whether that happens (or not). It is a pretty common technology on several brands.

As an example, From the OpenWRT page

LEDE/OpenWRT — Setting Up Client Isolation

Client Isolation is a security feature that prevents wireless clients on that network from interacting with each other, which can be enabled on networks in AP mode.

In Enterprise Cisco parlance, this is know as "Peer-to-Peer Blocking"

From Cisco Wireless LAN Controller Configuration Guide

Peer-to-peer blocking is applied to individual WLANs, and each client inherits the peer-to-peer blocking setting of the WLAN to which it is associated. Peer-to-Peer enables you to have more control over how traffic is directed. For example, you can choose to have traffic bridged locally within the controller, dropped by the controller, or forwarded to the upstream VLAN.

Peer-to-peer blocking is supported for clients that are associated with the local switching WLAN.

A key point here is "you can choose to have traffic bridged locally". The encryption protocol itself might mean each connection is private between the AP/controller and client, but then it is up to the controller /AP whether it allows (or not) the traffic to flow freely between the clients.

Also, I could found some vague references the Alcatel family of models the OP/@Tim is mentioning, calling it "Denying inter user traffic"

PS. I have enabled client isolation in my OpenWRT at home. Back in my former job, we also enabled this "feature" in a WiFi campus network of Meru aka Fortinet APs that served around 3k people per day.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .