4

I was wondering how could my computer that uses a spoofed MAC address be sending probe requests for APs that I was never connected to?

Note:- The other computer with the original MAC address was shut down.

Improve this question
3
  • Are there other devices sending out cached probe requests that your device is picking up and trying? – Jonathan Jan 29 '15 at 18:53
  • According to log from what system did your computer send probe requests? Might be another one spoofing the same MAC-Adress. – guntbert Jan 29 '15 at 18:57
  • Could that, what you call "probe for AP" be a Netbios packet? – ott-- Apr 29 '15 at 21:21
1

My understanding is that your OS is doing what is called an active scan: periodically sending probe requests to discover the AP's around it. The MAC address or the history of your connections is not relevant in that case.

Improve this answer
2
  • Hey Aviv, thanks for your answer! The thing is that some of these APs are out of reach (some of them even in another town), so as I understand it this would be impossible as an "active scan," no? – peter b Jul 3 '14 at 20:31
  • 1
    Are these APs ones which this device has been connected to in the past (with or without the spoofed MAC?). If so, I would suspect it is due to your OS, which is just looking to see if any known APs are available. – Tim X May 29 '15 at 23:53
0

It is a property of an OS (or you can say wireless card/driver) to automatically scan for the wireless network present in the vicinity.
It is because of this automatic scanning only, we use to get a list of wireless network in wireless settings (without even asked for).

Moreover, if system founds an Open Network, to which it had connected previously in the past, (i.e., wireless network without any security or WebAuth network) in the range, it will automatically connect to it.

Because of this feature only (automatic scanning of the wireless network by devices); Data Analytic companies (or advertisement companies) get to know about the number of users entered in any specific showroom in a shopping mall (or many other similar data sets).

Hope it answers your query.

Improve this answer
0

This is the property of OS to save PNL (preferred network list ) of the devices to which user connects ,so that next when the device comes in the range of AP it automatically connects to it on receiving Beacon frames

changing MAC address cannot make a device alter its PNL , this strange connection to unknown network is to be taken seriously , look for sum installed bug in your device

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.