How to find MAC address of a mobile phone which is in range of my Wi-Fi network but not connected

Question

It is clear that some big malls are tracking some Wi-Fi enabled mobile phones. How can it been done?

I have the similar issue: How to get the MAC address of a mobile phone when it comes near to my network but is not connected to it.

Solution

Wireshark or any other 802.11 monitor mode packet capture tool will let you tune each of the different Wi-Fi channels and try to capture packets from any device transmitting on that channel.

These transmissions almost always contain the MAC address of transmitting device.

Wi-Fi client devices, when not connected to any network, will periodically scan to see if there are any networks they can join. These scans are typically "active scans", where the device transmits a Probe Request frame, and hopes to receive Probe Response frames in reply from any nearby Wi-Fi access points (wireless routers). Probe Requests contain the MAC address of the sender, and often contain the network name (SSID) that the client is searching for.

Probe Requests are usually sent using some of the oldest modulation schemes, so you don't need to worry about having an N or AC card in your sniffer machine. Any monitor-mode-capable Wi-Fi interface, which supports the bands & channels you care about, will do.

After that you just have some implementation details like figuring out how many sniffer stations you need to cover all the area that your network covers (maybe about one per AP), and you'll probably want to write a script to differentiate between the known MAC addresses of devices that joined your network, and the MAC addresses that the sniffers saw that never joined your network.

Comments

[spartan]

hey Spiff thankyou for letting me know this, but i want to capture the MAC address of a not connected device without using any tool like wireshark

[gronostaj]

@spartan how do you imagine doing it without any tool? Obviously you need something that will capture packets and extract MAC addresses.

[spartan]

by keeping my wifi card in monitor mode i got all the packets transferring in the networks ... i.e like all the available networks and all... but i specifically didn't get any mac address of a device which is available in that network zone... can you help me on it ...thank you

[Spiff]

@spartan You need to make sure that your wireless card supports 802.11 monitor mode, not just promiscuous mode. You need to have your wireless card disassociate (disconnected) from any network, but still turned on (obviously). You need to tell it (possibly outside of Wireshark) to tune to a channel, and then you need to tell Wireshark to do a promiscuous PLUS monitor mode capture, with the link type set to 802.11 or 802.11 plus Radiotap. You might want to ask a new Question on this topic: "How can I configure my Wireshark machine to capture all packets on a channel, not just my BSS?"