mjhjmtu

When I use a wifi hotspot, sometimes I can't use sudo arp-scan -l to see other devices (except the hotspot), but sometimes I can see another laptop, but I never see another android phone. (The hotspot is borrowed from a public library, and the first hotspot I have ever used, so I don't know about it but guess its model is Alcatel Mw41 based on its appearance.)

When I use a router, most always I can see the other two devices (sometimes not).

I was wondering if a hotspot works differently, or arp-scan doesn't work sometimes?

Thanks.

In several implementations of wireless APs either domestic or enterprise, you can choose whether or not you allow clients talking with each other.

If that security measure is enabled, the clients will be only able to talk with the AP/the outside networks, but not with other clients under the same network/AP/controller.

From the top of my head, as examples, OpenWRT, Cisco and Meru allow to configure whether that happens (or not). It is a pretty common technology on several brands.

As an example, From the OpenWRT page

LEDE/OpenWRT — Setting Up Client Isolation

Client Isolation is a security feature that prevents wireless clients
on that network from interacting with each other, which can be enabled
on networks in AP mode.

In Enterprise Cisco parlance, this is know as "Peer-to-Peer Blocking"

From Cisco Wireless LAN Controller Configuration Guide

Peer-to-peer blocking is applied to individual WLANs, and each client
inherits the peer-to-peer blocking setting of the WLAN to which it is
associated. Peer-to-Peer enables you to have more control over how
traffic is directed. For example, you can choose to have traffic
bridged locally within the controller, dropped by the controller, or
forwarded to the upstream VLAN.

Peer-to-peer blocking is supported for clients that are associated
with the local switching WLAN.

A key point here is "you can choose to have traffic bridged locally". The encryption protocol itself might mean each connection is private between the AP/controller and client, but then it is up to the controller /AP whether it allows (or not) the traffic to flow freely between the clients.

Also, I could found some vague references the Alcatel family of models the OP/@Tim is mentioning, calling it "Denying inter user traffic"

PS. I have enabled client isolation in my OpenWRT at home. Back in my former job, we also enabled this "feature" in a WiFi campus network of Meru aka Fortinet APs that served around 3k people per day.