2

Say that I am within range of a Wi-Fi network that is encrypted using WPA2, but I don't know the password. Is it possible for me to learn the MAC address of the Wi-Fi router that is broadcasting the network? If so, how?

Improve this question
0

2 Answers 2

Reset to default
4

Yes! Using airodump you can look for WiFi networks around you. You can the look for devices on a specific WiFi network (this includes the router) by specifying the bssid. Your WiFi adapter should start finding devices connected to the AP.

Note: You need a WiFi adapter that supports monitor mode. Here are the commands:

First we have to start our WiFi adapter card, go ahead and do

1.) airmon-ng check kill airmon-ng start [interface]

(The first commands kills all processes the might cause problems) This will put your WiFi adapter card into monitor mode, letting you scan for WiFi networks. Your WiFi card should be renamed to something like mon0 or wlan0mon. Use this name in commands from now on.

2.) airodump-ng [interface]

  • This command will start finding WiFi networks around you. Remember the BSSID of the WiFi network you want to look for devices on.

3.) airodump-ng —bssid [bssid] -c [channel number, can be found when scanning for the network] [interface]

  • This command will scan on the WiFi network, it will look for devices connected to the AP. It should give you the MAC addresses of the devices connected, including the router.

That should do it! Forgive me for formatting mistakes as I am on my phone.

Improve this answer
2
  • 2
    Before step one, you would also want to run # airmon-ng check kill to kill any processes that interfere with the aircrack-ng suite. aircrack-ng.org/doku.php?id=airmon-ng
    – they
    Commented Nov 13, 2018 at 13:20
  • 1
    Will edit that into my answer.
    – CoderPE
    Commented Nov 13, 2018 at 13:27
1

Is it possible for me to learn the MAC address of the Wi-Fi router that is broadcasting the network?

Yes. Only the data portion of 802.11 frames is encrypted. The headers are not, so you will be able to see any of the information contained in them (including any addresses - source, destination, transmitter and/or receiver).

If so, how?

Easiest way is to use the built in tools available from the OS, although there are any number of other applications/tools which can be installed that will also provide this information.

For example, on a Windows client you can open a command prompt and use the following command:

 netsh wlan show networks mode=bssid

On Linux you have several options, my personal favorite is (scan is generally not needed but will trigger a fresh scan if used):

 sudo wpa_cli scan
 sudo wpa_cli scan_results

Or if you want more information, the following:

 sudo iwlist scan

I don't generally use OSX, but several years ago I followed the directions in this OSXDaily article which worked well. I can't verify the information now, so your mileage may vary.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .