can (should?) packets from unauthentcated wifi devices enter layer2 ?

[devzero () web de]

hi, 

i wondered for a while, why our (mac whitelist based) network-intrusion 
rarely reports unknown mac adresses on our internal network.

i found, that when you just try to login into our internal wifi with wrong 
password, i see frames (apparently from the non-authenticated device) appear 
on layer2.

i'm not deep enough into wifi and wanted to dig into this, but have 
difficulties finding appropriate information.

from my basic understanding of security and "layers" i'm really surprised to 
"see some foreigner inside my house while he has no key for the front door"

maybe somebody has a clue or a right keyword where to look further...!?

roland


# tcpdump -ni eth2 ether host 3c:8b:fe:44:37:29 -s0 -X
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
16:44:41.662985 3c:8b:fe:44:37:29 > Broadcast Null Unnumbered, xid, Flags [Response], length 46: 01 00
        0x0000:  8101 0000 0000 0000 0000 0000 0000 0000  ................
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 00              ...........
16:45:07.100952 3c:8b:fe:44:37:29 > Broadcast Null Unnumbered, xid, Flags [Response], length 46: 01 00
        0x0000:  8101 0000 0000 0000 0000 0000 0000 0000  ................
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 00              ...........

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/