2

Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me find this packet?

1

Every successful connection to Access Point will pass following steps:

  1. Probe
  2. Authentication
  3. Association/Re-association

So filtering Association/Re-association Response packets will help to find out connected devices. Consider that these packets are management packets (not control). Following display filter of Wireshark shows Association/Re-association Response packets:

wlan.fc.type_subtype == 0x01 || wlan.fc.type_subtype == 0x03
1

Not really.

Re-associations by existing devices (e.g.: coming out of hibernation, roaming from other APs etc) would appear identical to a new device joining.

Short of writing a display filter that matched associations NOT from existing MACs on your network, this would be very complex to do.

You would be better off tackling this from another perspective - e.g.: monitoring new DHCP leases (since most DHCP servers will maintain MAC-to-IP mappings for existing devices).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.