Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me find this packet?
Every successful connection to Access Point will pass following steps:
So filtering Association/Re-association Response packets will help to find out connected devices. Consider that these packets are management packets (not control). Following display filter of
Wireshark shows Association/Re-association Response packets:
wlan.fc.type_subtype == 0x01 || wlan.fc.type_subtype == 0x03
Re-associations by existing devices (e.g.: coming out of hibernation, roaming from other APs etc) would appear identical to a new device joining.
Short of writing a display filter that matched associations NOT from existing MACs on your network, this would be very complex to do.
You would be better off tackling this from another perspective - e.g.: monitoring new DHCP leases (since most DHCP servers will maintain MAC-to-IP mappings for existing devices).