I tried using nmcli to get the access_point list, but I got multiple entries with the same SSID and some with a null SSID. I'm not sure whether this is a problem.
My system info: Linux Raiden 6.10.10-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 12 Sep 2024 17:21:02 +0000 x86_64 GNU/Linux
NetworkManager version: 1.50.0-1
I want to know why NetworkManager returns the same SSID and null SSID.
In your example, there are two instances of SSID BLW-8A and three instances of SSID H3C, each with different BSSIDs. There are also two null SSIDs, both with BSSIDs very similar to the ones used by the SSID BLW-8A.
The BLW-8A has a BSSID of 80:EA:07:F8:8E:B7 on channel 1 (= in the 2.4 GHz frequency band) and 80:EA:07:F8:8E:B9 on channel 149 (= in the 5 GHz band). The BSSIDs are almost consecutive, so these BSSIDs are most likely different radio modules on the same access point device. Therefore, BLW-8A seems to be a single access point with both 2.4 GHz and 5 GHz radios, and it's currently configured to offer the same SSID on both frequency bands.
The null SSIDs have BSSIDs 82:EA:07:A8:8E:B7 and 82:EA:07:D8:8E:B7, on channels 1 and 149 respectively. Both of those have the 2nd bit of the first byte of the BSSID set, indicating locally administered addresses. These BSSIDs are also very similar (with just a few bits of difference) to the BSSIDs of the BLW-8A access point.
My guess is that these might be a second pair of radio modules in the same BLW-8A access point device, perhaps providing access to a hidden SSID, or acting as a Wireless Distribution System or mesh link between base stations, or something like that. But I acknowledge this is just a guess and might well be wrong.
The three instances of the SSID H3C are all operating on different 2.4 GHz channels, and while their BSSIDs are all different, they all have the same vendor part: googling for a "MAC address lookup" and looking up the BSSIDs indicates the vendor is "New H3C Technologies Co., Ltd" which agrees with the common SSID. So, these would seem like a multi-access-point wireless network that's implemented using hardware from a single vendor, and probably with a centralized access point controller system.
Since you managed to catch three access points belonging to the H3C wireless network at once, it suggests the APs of that network have perhaps been placed in a denser arrangement than strictly necessary (to ensure good coverage?). The fact that the network is available on 2.4 GHz channels only suggests it is probably not using the newest hardware available.
Since the SSID H3C reflects the hardware vendor, it suggests the network might have been set up using mostly factory default settings.
