Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I would like to know if it is technically possible to detect and recognize a client (PC/smartphone) during its wifi scan.
My goal is to get the list with identifiers like mac address or other unique id of the surrounding devices. But these devices are not actively connected to my wifi but maybe I can catch them while they are scanning wifi networks.
It is possible and which antenna do I need?
If the Wi-Fi client is only passively receiving during the scan it cannot be detected.
If it is however transmitting only a single frame you can collect its MAC address. Nothing special required, just the access point (or any other Wi-Fi device listening to the same channel) logging all source addresses, even unconnected ones.
Note however that very routinely MAC addresses are spoofed, especially for attackers or where users are concerned about privacy.
To expand on @Zac67's answer:
If the device is passively scanning for access points it's listening for beacon frames (one kind of 802.11 management frames) coming from any access point.
If the device is actively scanning for access points it sends out a different kind of 802.11 management frames, namely probe request frames. (some more background)
Those probe request frames can be captured by any standard WiFi card that supports monitor mode. When in monitor mode you can use a program for packet capturing (e.g. Wireshark) and look for probe request frames which contain the sender's MAC address.
Naturally as with anything RF, a better antenna gives you better reception and you will be able to receive probe request frames of devices which are farther away from you.
Fluke Aircheck WiFi scanner costs $2k and has a clients screen which shows the Mac addresses of probing clients. I love the aircheck for WiFi troubleshooting and scanning, but using it to find specific clients is hard due to the small screen and inability to “cut-and-paste” your data. It’s more a fit for finding rogue access points and WiFi interference.
Metageek.com has some good WiFi scanning solutions. They used to have “scanner dongles” which would connect to your laptop and were superior to using the built-in WiFi antenna because that could only be on one channel at a time.
