I would like to make a presence detection application which would be able to detect when a known device connects to the local Wifi network. So basically I would know the MAC address of the device, but the IP is dynamically assigned so it can change.

I can only rely on the known MAC to determine if the device is here or not, how can I do that ?

I have thought about one possibility :

  • do a broadcast ping on my network (ping the 255 possibly IPs).

  • then do a arp request and look into the ARP table and try to find the known MAC

  • if I find it, the device is here and I can see the IP, if the MAC is not there then the device is not on the network

This could possibly work but it is not smart and requiers a permanent ping broadcast which can be slow in some cases according to my experiments. And it would not be energy efficient as well.

I am from Electrical Engineering and don't have a huge background into networks, so please pardon my maybe dumb question. Hope somebody will be wiling to help me :)

Thank you.

  • 1
    Most MAC addresses can be changed by the owner of the device. I'm not sure why you are doing this, but this may not be reliable enough for you.
    – Ron Maupin
    Jul 2, 2015 at 19:42
  • The idea is to detect people presence in their house through their smartphone for different Smart Home applications (in a total transparent, legal and accepted way because the service would be asked by people). I am aware that MAC address can be hidden and changed using a software, but I would assume that the users will not do so because they have no interest in doing so. Anyway, do you know a more reliable thing that I could possibly use instead of MAC ?
    – phenetas
    Jul 2, 2015 at 19:46
  • 1
    Most smart phones are already very "chatty" when the connect to the LAN. They typically employ Apple's Bonjour or another protocol to broadcast their presence on the local LAN to discover and advertise services. I would think just listening for such traffic would suffice for you to discover them typically.
    – YLearn
    Jul 2, 2015 at 20:06
  • That is what I thought at the beginning and I started to do a bunch of things and learning Bonjour & mDNS and the related topics, but after a few days ... I realized that Apple's doing everything to avoid tracking of their phone. So basically, iPhone does not advertise itself as it has no Bonjour service at all. The only way to register a service is through an App, but I don't want to rely on an app. iPhones turn off their wifi chip after a few seconds in sleep mode and then do not respond to ping request. And to finish iPhones sometimes change their MAC address while seeking for WiFi.
    – phenetas
    Jul 2, 2015 at 20:16
  • I would think that if this is a voluntary participation, the users would want to run an app which logs itself in. This would be the most accurate way to identify a user. This would still not prevent a phone from being turned off (accidentally, or otherwise). You could have the app send the GPS coordinates, or any other information as an enhancement, to give the most flexibility.
    – Ron Maupin
    Jul 2, 2015 at 20:59

4 Answers 4


Filter the output of tcpdump by MAC address:
sudo tcpdump ether host A1:B2:C3:D4:E5:F6
Add other options as needed.


The simplest, passive method would be listen to ARP traffic (broadcast) to detect when a device is on the network. A more involved method would be to add some form of "agent" on the AP to be notified of all associations/disassociations. If you're using DHCP, you could watch there as well.

  • Thank you Ricky for your response. Could you develop a bit and/or give me some clues about how to listen to ARP traffic ?Using the ARP commands on my laptop I can only read MAC associated with a given IP.
    – phenetas
    Jul 6, 2015 at 17:26

I can only rely on the known MAC to determine if the device is here or not

Looking for a MAC address may not be reliable. MAC addresses can be easily spoofed and many wireless devices randomize their MAC address for privacy.

Listening to broadcasts is even less reliable unless the listener is located very close to the access point (WAP). The more distance you put in between, the more traffic on the far side of the WAP the listener misses.

If you want to reliably identify specific clients you'll need to check the WAP since it's the only one seeing all traffic and logins. Using an SNMP trap seems reasonable.

Additionally, you can't use WPA-PSK, but each client/user needs to use individual authentication for proper identification (WPA-Enterprise with RADIUS).

However, if there's no risk of the clients' MAC addresses to be spoofed or randomized, you could use DHCP reservations to avoid fully dynamic IP addresses. Then you can just ARP for a specific IP address and check for a reply. Another option is to monitor the DHCP server for new leases and extensions.


So I have continued to search how to solve my problem, and I found that using the tcpdump tool could help me a lot.

sudo tcpdump -e -f can listen to all data transferred through wifi, and read the header of packets as they are usually not cryptic. And the -e option show me the MAC address.

It works well, but I would like to narrow the results to display only the interesting MAC address. I tried sudo tcpdump -e -f src myMacAddress where myMacAddress is the interesting MAC, but it returns me an error and stop the execution

tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed: pcap_add_if_info: pcap_compile_nopcap() failed

  • Listening for frames on a wireless device might not receive all frames there are unless the listener sits right next to the access point.
    – Zac67
    Apr 13, 2021 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.