I would like to make a presence detection application which would be able to detect when a known device connects to the local Wifi network. So basically I would know the MAC address of the device, but the IP is dynamically assigned so it can change.

I can only rely on the known MAC to determine if the device is here or not, how can I do that ?

I have thought about one possibility :

  • do a broadcast ping on my network (ping the 255 possibly IPs).

  • then do a arp request and look into the ARP table and try to find the known MAC

  • if I find it, the device is here and I can see the IP, if the MAC is not there then the device is not on the network

This could possibly work but it is not smart and requiers a permanent ping broadcast which can be slow in some cases according to my experiments. And it would not be energy efficient as well.

I am from Electrical Engineering and don't have a huge background into networks, so please pardon my maybe dumb question. Hope somebody will be wiling to help me :)

Thank you.

  • 1
    Most MAC addresses can be changed by the owner of the device. I'm not sure why you are doing this, but this may not be reliable enough for you. – Ron Maupin Jul 2 '15 at 19:42
  • The idea is to detect people presence in their house through their smartphone for different Smart Home applications (in a total transparent, legal and accepted way because the service would be asked by people). I am aware that MAC address can be hidden and changed using a software, but I would assume that the users will not do so because they have no interest in doing so. Anyway, do you know a more reliable thing that I could possibly use instead of MAC ? – phenetas Jul 2 '15 at 19:46
  • Most smart phones are already very "chatty" when the connect to the LAN. They typically employ Apple's Bonjour or another protocol to broadcast their presence on the local LAN to discover and advertise services. I would think just listening for such traffic would suffice for you to discover them typically. – YLearn Jul 2 '15 at 20:06
  • That is what I thought at the beginning and I started to do a bunch of things and learning Bonjour & mDNS and the related topics, but after a few days ... I realized that Apple's doing everything to avoid tracking of their phone. So basically, iPhone does not advertise itself as it has no Bonjour service at all. The only way to register a service is through an App, but I don't want to rely on an app. iPhones turn off their wifi chip after a few seconds in sleep mode and then do not respond to ping request. And to finish iPhones sometimes change their MAC address while seeking for WiFi. – phenetas Jul 2 '15 at 20:16
  • I would think that if this is a voluntary participation, the users would want to run an app which logs itself in. This would be the most accurate way to identify a user. This would still not prevent a phone from being turned off (accidentally, or otherwise). You could have the app send the GPS coordinates, or any other information as an enhancement, to give the most flexibility. – Ron Maupin Jul 2 '15 at 20:59

Filter the output of tcpdump by MAC address:
sudo tcpdump ether host A1:B2:C3:D4:E5:F6
Add other options as needed.

| improve this answer | |

The simplest, passive method would be listen to ARP traffic (broadcast) to detect when a device is on the network. A more involved method would be to add some form of "agent" on the AP to be notified of all associations/disassociations. If you're using DHCP, you could watch there as well.

| improve this answer | |
  • Thank you Ricky for your response. Could you develop a bit and/or give me some clues about how to listen to ARP traffic ?Using the ARP commands on my laptop I can only read MAC associated with a given IP. – phenetas Jul 6 '15 at 17:26

So I have continued to search how to solve my problem, and I found that using the tcpdump tool could help me a lot.

sudo tcpdump -e -f can listen to all data transferred through wifi, and read the header of packets as they are usually not cryptic. And the -e option show me the MAC address.

It works well, but I would like to narrow the results to display only the interesting MAC address. I tried sudo tcpdump -e -f src myMacAddress where myMacAddress is the interesting MAC, but it returns me an error and stop the execution

tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed: pcap_add_if_info: pcap_compile_nopcap() failed

Can someone help me with that ?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.