I would like to distinguish the behavior of users to use a (public) Wi-Fi access point. It would be possible to access the log files of the access point, but I don't have the authority to.
Alternatively, I set this experiment for sniffing (sensing) the Wi-Fi packets:
There is an access point; there are many users, too
I set Wi-Fi sensors built on Raspberry Pi to collect the Wi-Fi packets from the users and AP.
Simply, As the MAC address of destination and origin were the device and the AP, the device was thought to be using the AP when it was sent and received by the data frame (not the management frame).
However, there are four sub-types in the data frame. Although not sure, QoS NULL and QoS data do not appear to be using data.
In this situation, do you have any ideas to detect the usage of WiFi AP by sniffing the packet? All of data frame can be considered to determine the usage of Wi-Fi AP?