Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me find this packet?
2 Answers
Every successful connection to Access Point will pass following steps:
- Probe
- Authentication
- Association/Re-association
So filtering Association/Re-association Response packets will help to find out connected devices. Consider that these packets are management packets (not control). Following display filter of Wireshark shows Association/Re-association Response packets:
wlan.fc.type_subtype == 0x01 || wlan.fc.type_subtype == 0x03
Not really.
Re-associations by existing devices (e.g.: coming out of hibernation, roaming from other APs etc) would appear identical to a new device joining.
Short of writing a display filter that matched associations NOT from existing MACs on your network, this would be very complex to do.
You would be better off tackling this from another perspective - e.g.: monitoring new DHCP leases (since most DHCP servers will maintain MAC-to-IP mappings for existing devices).
