0

There is a project at the university, there are a lot of mobile phones where the wifi works in passive mode and is not connected to an access point. Is it possible to get the MAC address of these devices, given that they are not access points?

How do I understand the command airdump-ng is looking only for access points?

In the project, I use tp-link mr3020 and openwrt.

It is necessary to determine student attendance.

If there is no ready-made solution, can you tell which way to look for information in terms of programming?

  • 1
    Welcome. Couple of things: passive mode kind of suggests that they are not actively sending packets. Thus, you cannot know their MACs. Additionally, it's not clear what you are asking for exactly and I smell an xy problem. Could you be more verbose regarding: what you are trying to do and where you run into problems as well as how what you're doing is legal for you? – Tobi Nary Feb 8 at 13:38
1

How do I understand the command airdump-ng is looking only for access points?

By default airodump-ng wlan0 will listen for any 802.11 devices beacons (master and managed mode) at 2.4 GHz. So, you know it is not only capturing AP beacons, your only alternative is to filter clients later using something like Wireshark if this is an issue. It is important to realise you are entering your Wi-Fi card into monitor mode (not managed mode) for this type of surveillance.

I do understand this can be an issue, so I would suggest specifying the BSSID of the AP before you start capturing and writing to a file in Airodump-ng, as the legality of intercepting traffic outside of your network is in question.

It is necessary to determine student attendance.

I do not understand exactly what you are asking here. But, you can look through all BSSIDs associated with your station (AP) MAC address in airodump-ng or Wireshark. This screendump was not generated by me, source: https://hackingvision.com/wp-content/uploads/2017/04/Screenshot-from-2017-04-25-01-41-07.png

Is it possible to get the MAC address of these devices, given that they are not access points?

Passively via monitor mode, presuming you are within the distance of capturing beacons of the clients, then yes! You will see this in the image above.

To present this data in a more readable or appropriate format look at the Aircrack-ng documentation and Wireshark. Although, for anything regarding capture dumps, I would recommend Wireshark for processing and filtering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.