How to sniff for wireless MAC addresses in area - My laptop got stolen

Question

A few days ago my apartment got broken in, and they took all the electronics, including my $1500 laptop.

We are pretty sure it's an inside job (as in someone from the same building), so I believe that the stuff is in someones apartment.

Is there any tool that tells you what wireless adapters are active within range? I have my laptops MAC address, so I could use that to find out who stole it. I think it's worth a shot.

Any help is appreciated thanks!

Solution 1

Fire up Backtrack if you haven't already. Since you're not after traffic - just the level 2 address - this should be easy.

First, start airodump-ng and with the command

airodump-ng  --berlin 60 <wireless interface here>

You'll get a screen that looks like:

In the area marked client there is a column describing power in decibels (i.e. the more positive the number the better.

Second, walk around until you see your target MAC pop up on the screen in the client area.

Third, continue walking around using the strength readout to home in on the laptop.

Note: this is by no means incredibly accurate or guaranteed to work at all.

Solution 2

MAC address is changeable, quite easily actually.

But, I guess you could always try with netstumbler, ethereal, or something alike.

Solution 3

I know that KisMac (a Mac OS X app, that can passively sniff Wireless networks) will show all wireless MACs that have associated with any base station that it can see traffic from [though it also sometimes shows the MAC of the host you're sniffing with], so I suspect that most of the other common wireless LAN tools can do it too.

(Be sure that you're looking for your laptop's wireless MAC!)

Solution 4

The tools mentioned in ldigas' answer are the way to go (netstumbler, ethereal)

The trick is finding out exactly where near you he (or she) may be. That takes strong signal strength analysis and triangulation.

What you should do is tell the police if you find the address. They can then do the legal legwork to find out where they are connecting to and back track them. Let them do their job (hopefully). At a minimum make sure the MAC address is in the police report.

View more solutions

Comments

[Admin]

(Just in case you got the MAC address from the configuration of a Time Machine backup: that's always the MAC address of the first network card, which often is the MAC of the ethernet connection, not of the AirPort.)

[Admin]

Hi infinity, how'd this turn out for you? Did you find the culprit?

[Admin]

Did you ever find the thief?

[Admin]

@FreeAsInBeer Yeah, interested to know as well, just stumbled onto this question.

[Jared Harley]

I was going to make the same recommendation, but I was trying to figure out if netstumbler can see other wireless cards or just access points...

[Arjan]

I doubt it's likely that someone who has stolen the laptop will have changed the MAC address.

[William Entriken]

You also answered my question at: electronics.stackexchange.com/questions/93359/… -- free points if you copy the answer there