Hidden network, can't connect

Having some issues with a WiFi network and I can't figure out what the issue is.

On another phone that is connected to the network we can show a qr code on that device so we can connect another device and that works fine.

But we have a security camera we are trying to add but have to enter the connection info manually.

But it won't work. It's the right said and password as far as I know. It's using WPA and DHCP.

The QR code says the folling

WIFI:S:Devices 1;T:WPA;P:password;H:true;;

Is there some bit of info in that that's missing when we are entering the details manually?

Don't use the "hidden" SSID option for any permanent / live setup
1) it isn't hiding anything
2) an SSID is not a username, password or other credential
3) is not an official part of the standards so is implemented in inconsistent fashion,
4) leads to unpredictable problems with connecting devices or roaming to another AP,
5) causes clients of said network to probe any other AP in range in effect asking "do you have the network I am looking for?"


(4) the SSID is used together with the RSSI and advertised supported data rates to determine when a client is in range of a network it knows about and when a "better" candidate AP becomes available
and conversely to determine when beyond usable range and should stop trying to connect to any/other AP.

(5) means you end up unnecessarily leaking data about the SSID if you have any phone / tablet with the SSID saved and you take it out on public whenever it sees another hidden network

If you want to increase security make the password longer (if not using user or device client certificates)

Well, thats all stuff for the IT department to deal with. Above my paygrade!

I'm just trying to figure out why the QR code lets a device connect fine, but entering the same info manually does not.

Hi,

You might need to add the MAC address(es) of the camera(s) that wish to have access to your network as there might be MAC address blocking enabled to prevent unauthorised devices from accessing your network. There should be a section of your router that allows you to add devices to a Whitelist. You could also trying using WPS to add the device, if that is an option.

HTH,

What network standards does the camera support? It could be that some networks standards are disabled on the WAP and that the camera doesn't support the ones that are enabled.

Also, if you have an IT department then why are you connecting a camera to the network - has the IT department approved it and if not then don't you have an acceptable use policy that says not to connect unapproved devices to the network? If they have approved it then why aren't they connecting it for you?

Edited by ian72 (Thu 28-Aug-25 08:55:30)

In reply to a post by ian72:

... if you have an IT department ...

I took the reference to the IT department to be a flip comment.

In reply to a post by Seansmit17:

I'm just trying to figure out why the QR code lets a device connect fine, but entering the same info manually does not.

Maybe there is a non visible character in the passcode? Or the connection is using WPA3 and the device only supports WPA2...? or there is some mixed mode old style WPA1/WPA2 with TKIP which is horribly insecure but many ISP routers defaulted to.

You may have to scan the QR with something that decodes it into hex, so you can see exactly what is being provided.

My understand is a hidden SSID is more vulnerable than a visible SSID. On my setup it actually warns you not to do it when you try to set a hidden SSID

In reply to a post by DFScale:

In reply to a post by ian72:

... if you have an IT department ...

I took the reference to the IT department to be a flip comment.

I must admit I considered that but really couldn't tell.

If it is just their home networking then I am going to guess the camera does not support either current security protocols or current network standards - but without knowing what camera it is or how the router is configured it is largely guesswork.

Not wishing to teach you to suck eggs but:
Is it a duel band router?
If so, is the device you are using to access the UI on the camera operating on the same band you are trying to connect the camera to?
Have you tried temporarily setting the router to operate only on the band that you want to connect the camera to?

The wifi set up is access points back to a central router.

We have "Public" WIFI, and then WIFI for our own company devices.

I have no access to anything to check stuff.

Its defo WPA, But not WPA3. so 1/2. If I copy the settings I can see on a device that's connected and copy it over, it wont connect.. Only via the QR code does this work and that's what I am trying to figure out. If I am entering the info that's in the QR code... why wont another device connect?

Why is it only working via the QR code. I need to check on some of our phones/tablets if Android will show us what password is being used to connect vs getting it from the QR code. Maybe as suggested there's something hidden or funky with it.

I say IT department, they actually are but they are about as much use as a wet fart.

Our internet stopped working after a power outage... I was the one who fixed it in the end by just re-plugging in all the network cabling between the incoming fibre connection and the switch to the WIFI/office... A power cycle didn't fix it, they just kept trying to remote in... Instead of just coming over to the building!

Anyway.. The mystery continues. I guess the SSID is hidden to stop random people trying to connect to it?? Who knows.

I work in IT - I would be highly miffed if someone was randomly connecting security cameras into my network. I may even have deployed some technologies to stop this...

I suspect this is either security or wifi standards that is stopping it from working. I am not going to advise you continue as from an IT perspective I have a strong suspicion that you probably shouldn't be doing this - my advice, no matter how bad you feel your IT is, would be to talk to them to understand how the WiFi is setup and whether there is anything that would stop you connecting an unsupported device that could risk the security of the network.

They sent the camera for us to hook up. Like I said, the couple lads that work the department are not that great. I know more yet cant get that kind of job... but anyway.

One of them came in today to have a look and he cant get it working either.

He said theres nothing funky with it, its just 2.4/5Ghz WiFi5 with a hidden SSID using WPA Encryption. WPA is for legacy compaitibility with some older WiFi gear they have.

In reply to a post by Seansmit17:

WPA is for legacy compaitibility with some older WiFi gear they have.

Given how easy it is to crack WPA, [censored] are they thinking?

At the very least that equipment should be completely isolated from the rest of the network so if someone did get in it only compromised those devices.

Mind you, a WiFi Security Camera always seemed an oxymoron to me, given how easy it is to block WiFi signals and cameras are prone to having really bad chinese software running them to begin with.

Edited by alexatkin (Fri 29-Aug-25 15:15:51)

Fair enough. My next move would be to take the camera home (if you are allowed) and connect it to home wifi. If that works then I would try clearing the connection info, hiding the SSID on the home wifi and seeing if you can connect then - that might show if the camera is not capable of connecting to a hidden SSID. It is vaguely possible the camera may only support a later version of WPA and hasn't implemented the legacy version.

Are you willing to share the make and model of the camera?

I'd have a different definition of funky as wireless devices since 2006 were required (for certification+logo) to support WPA2
so anything that only does WPA or WEP is beyond reasonable for legacy use.

Also 2006 is prior to 802.11n so there is a chance that devices not capable of WPA2 only do 802.11b/g,
It can be preferable to operate them on a separate SSID while remaining pre-n devices are phased out.
That way the regular SSID(s) can reject poor connections where the supported data rate drops below 12Mbps and exclude 802.11b completely.

Similarly the legacy WPA-only support should never be enabled on the regular SSIDs,
it should be treated as an insecure network not sharing a subnet with office/corporate items.
In current best practice, SSIDs can use WPA2, WPA3 or a mixed mode WPA2/3 based on what you know about client device capabilities.

The QR code method does not necessarily specify whether to connect using WPA/WPA2/WPA3 but does distinguish between Open, WEP and WPA(any version).

In any case the earlier comment about hidden networks stands and now appears with like layering further incompatibility it's no wonder that the behaviour is inconsistent.

Edited by prlzx (Fri 29-Aug-25 16:26:34)

I seem to remember that with some wireless access points that if a legacy standard (like 802.11b) is turned on and a device is connected using that (because it is legacy and only supports it) that the WAP would only use it for other devices. If the camera then didn't support 802.11b then it wouldn't be able to connect.

Could it be that the access point is effectively only offering 802.11b due to legacy device connections and therefore a camera that doesn't support 802.11b would not be able to connect?

In reply to a post by Seansmit17:

Well, thats all stuff for the IT department to deal with. Above my paygrade!

Then give the camera to the IT department to setup? They are arguably causing the problem due to their moronic way of setting up the WiFi, and therefore they should be given the camera to sort out.

Why are you wasting time messing about trying to connect a device to a network you are not in control of? Like asking for advice how to drive your mates car without being supplied the keys.

Other way around in effect.

Client devices with a 2.4GHz radio are backwards compatible e.g. b/g/n
Client devices with a 5GHz radio are backwards compatible e.g. a/n/ac

However if the AP's SSID allows b clients it does so by slowing right down while talking to them.
Also the beacons and any other multicast/broadcast frames have to be sent at a lower rate to be decoded by the slowest clients allowed so it leads to wasted RF airtime.
Also it adjusts the framing and other parameters so that g/n transmissions don't corrupt other b frames.

On festival network SSIDs we routinely set the minimum supported data rate at 12Mbps (or even 24Mbps for zones of public connectivity).

We would also likely refuse to deploy a TKIP compatible SSID or hidden network and strongly discourage any proposals that would degrade the security and connectivity of essential site services.
This season we had to reject some ludicrously weak PSKs requested by client's contractor for EPOS networks and propose stronger alternatives.

Edited by prlzx (Sat 30-Aug-25 12:59:21)