4

I was watching a Meraki AP presentation, and one of the features they showed was an analytic tab, which showed the number of devices that passed by, visitors, and connected to the AP, as well as many other things.

I'm assuming passerby is defined as devices that are within the range of connectivity.

Perhaps my understanding of AP isn't correct, but I thought a WAP would be something like my wireless router, that allows devices to connect to a network.

Is the reason I'm not able to see devices that are "passerbys" in my router that my router doesn't have that feature?

How does a WAP see a passerby? Like is a mobile emitting something that the router can pick up?

Lastly, is it possible for a device to hide itself from WAPs?

Improve this question
3
  • Unless I'm completely mistaken, there is some back and forth between a device and the router to establish that there is something available to talk to.
    – Angelo R.
    Jun 24, 2015 at 16:35
  • @AngeloR. I was thinking (without really any base) that the router emits, devices are just able to see it. But then I remembered using air-crack before, and being able to see other devices, even when I wasn't in same network as them, so the devices must be emitting packets/data (whatever it is)...So I guess you're right
    – Honinbo Shusaku
    Jun 24, 2015 at 16:41
  • this is explained a bit more when talking about switching NICs into "Promiscuous mode".
    – Angelo R.
    Jun 24, 2015 at 19:53

3 Answers 3

Reset to default
3

Is the reason I'm not able to see devices that are "passerbys" in my router that my router doesn't have that feature?

Yes. By router I am assuming you mean some sort of consumer gateway device with built in 802.11 wireless (hereafter just "wireless"). These devices will not have many of the features found in enterprise solutions.

Any wireless device has to be at least somewhat aware of the other wireless devices operating around it, if only to avoid collisions when transmitting.

How does a WAP see a passerby? Like is a mobile emitting something that the router can pick up?

When you want to connect to a wireless network on your device, it generally will provide you a list of nearby networks. There are two ways that a device can discover this information, one active and one passive, however the active probe request is typically more common. Most devices will check fairly frequently for networks in the area.

For more detail on those processes, you may want to check my answer to another question.

Aside from that, if your device is communicating on the same channel (even with a different wireless network), nearby devices will be able to detect and record their presence. A common misconception is that if you use an encrypted wireless network, this entirely protects you. However the truth is that only the data portion of the 802.11 frame is encrypted, the headers still need to be sent in the clear.

Lastly, is it possible for a device to hide itself from WAPs?

Possible, yes. Although, this is unlikely as it would require that your device make no transmissions at all. A device that doesn't transmit at all isn't very useful to most people.

Improve this answer
3
  • Something I saw in the presentation was how the Meraki AP was able to see all the apps in the devices connected to it's network. For something like that, the phone would've had to have given explicit permissions right? Can a AP just see everything a device connected to it has?
    – Honinbo Shusaku
    Jun 25, 2015 at 17:41
  • It can't see the apps in the devices connected to the network. It can see the apps that are in use that make use of the network. This isn't a Meraki or even a wireless feature though, it is simple an analysis of the network traffic of the device and can be done at any point along the path (i.e. it is often included in shaping devices, firewalls and other devices at the edge of the network as well).
    – YLearn
    Jun 25, 2015 at 18:12
  • I guess I misunderstood what they were saying, and that was why I was surprised.
    – Honinbo Shusaku
    Jun 25, 2015 at 18:18
3

Access points can be configured to broadcast their SSIDs, or they can be configured to only listen for connections from devices that know a given SSID exists.

Virtually all wifi client devices (laptops, mobile phones, tablets, etc) will broadcast at least some information on a periodic basis. This is the information that a listening access point (or maybe more generally called an analytics gathering station) will hear and use to build maps and data sets of which devices are in the area.

How much or how little (or how often) any given device is broadcasting information or attempting to access the network is highly dependent on the individual device.

For a reasonably good introduction to how this stuff works, may I suggest:

https://en.wikipedia.org/wiki/Media_access_control

https://en.wikipedia.org/wiki/Wireless_LAN

https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_avoidance

Improve this answer
3

The Meraki AP's (the higher end ones) have 3 radios: 2.4GHz, and 5GHz for traffic, and a third "maintenance radio". That 3rd radio is what does all the spectrum monitoring and "security" scanning. It is that radio that can hear the non-associated devices within range of it, as long as they're speaking.

(The primary reason is to find/use the least congested channel(s). But it can also be used to find rogue devices. Call up anyone in Meraki Sales and they'll talk your ear off about it.)

Improve this answer
3
  • A number of vendors provide this option. However the third radio is not generally where the type of information asked about by the OP is gathered. As you mention, it is typically used for security scanning (so the main radios don't lose any cycles to it), spectrum scanning (which doesn't concern itself with 802.11 clients), or other maintenance tasks. APs are far more likely to gather this information from probe requests and any traffic it receives when not transmitting.
    – YLearn
    Jun 24, 2015 at 22:04
  • I'm just explaining how Meraki does it, not the full theory of wireless scanning.
    – Ricky
    Jun 24, 2015 at 22:13
  • This answer looks best. I imagine that 3rd radio provides much of the visibility of non-associated devices / passers by. Of course, a database somewhere has to keep record of all this stuff and correlate it and present it nice and pretty on demand.
    – Ronnie Royston
    Jun 27, 2015 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.