Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does someone know of a project or a way to "fingerprint" an access point (a router)? Fingerprinting should be done irrespective of broadcastet BSSID and ESSID. BSSID and ESSIS may be included in the fingerprint, but they should not be the only indicators.

share|improve this question
You might want to add MAC address to the list of things to exclude from fingerprinting signatures. – Iszi Feb 13 '12 at 13:27

One interesting fingerprint you could use is the clock skew. Since 802.11 APs typically broadcast their timestamp in beacon frames, the beacon frames provide a nice source of the devices clock skew. For more details, see "On Fast and Accurate Detection of Unauthorized Wireless Access Points Using Clock Skews".

share|improve this answer
Just found this! Very interesting and very interesting use case – Erik Feb 13 '12 at 16:13

How do you want to fingerprint access points; through OSI layer 1, 2, or above?

If you want to fingerprint them via OSI layer 3 or above, check out; it sounds promising - but I think its' fingerprinting abilities probably do not include access points; however, I've not tried it.

share|improve this answer

You can use nmap to carry out an element of this (if you look at the management port of the access point) - but this won't help you much if all you can see is the wireless part of the network and no ports are open on the access point's wireless network interface.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.