0

I would like to know if it is technically possible to detect and recognize a client (PC/smartphone) during its wifi scan.

My goal is to get the list with identifiers like mac address or other unique id of the surrounding devices. But these devices are not actively connected to my wifi but maybe I can catch them while they are scanning wifi networks.

It is possible and which antenna do I need?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 5:17

3 Answers 3

3

If the Wi-Fi client is only passively receiving during the scan it cannot be detected.

If it is however transmitting only a single frame you can collect its MAC address. Nothing special required, just the access point (or any other Wi-Fi device listening to the same channel) logging all source addresses, even unconnected ones.

Note however that very routinely MAC addresses are spoofed, especially for attackers or where users are concerned about privacy.

1
  • Thank you for your answer, as far as you know commons smartphones (ios, android) are not sending some frames to get ssid information (is open, enc type)?
    – Tobia
    Jul 14, 2019 at 20:51
3

To expand on @Zac67's answer:

If the device is passively scanning for access points it's listening for beacon frames (one kind of 802.11 management frames) coming from any access point.
If the device is actively scanning for access points it sends out a different kind of 802.11 management frames, namely probe request frames. (some more background)

Those probe request frames can be captured by any standard WiFi card that supports monitor mode. When in monitor mode you can use a program for packet capturing (e.g. Wireshark) and look for probe request frames which contain the sender's MAC address.

Naturally as with anything RF, a better antenna gives you better reception and you will be able to receive probe request frames of devices which are farther away from you.

2
  • Thank you very much, I found some "monitor mode" topic and you gave me a good start point. Now the point is to find some hardware with this mode. Do you have any suggestion?
    – Tobia
    Jul 14, 2019 at 20:52
  • I don't really have a specific suggestion, but maybe this blog post can help you along.
    – oh.dae.su
    Jul 14, 2019 at 21:29
0

Fluke Aircheck WiFi scanner costs $2k and has a clients screen which shows the Mac addresses of probing clients. I love the aircheck for WiFi troubleshooting and scanning, but using it to find specific clients is hard due to the small screen and inability to “cut-and-paste” your data. It’s more a fit for finding rogue access points and WiFi interference.

Metageek.com has some good WiFi scanning solutions. They used to have “scanner dongles” which would connect to your laptop and were superior to using the built-in WiFi antenna because that could only be on one channel at a time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.