Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it?

Sniffing packets with Wireshark or others does not give any info, but I remember once using a tool like reaver I saw my AP model (I was cracking it) in output.

Is there any network reconnaissance packet I can send to the AP that does the job? How did reaver detect my AP model?

  • You can get the some information (brand) using tools like "MAC Address Lookup", try seaching on google.
    – fgpr0x
    Sep 9, 2015 at 10:48
  • 1
    It's not about MAC lookup tools as mac address can be easily changed I want to know the exact informations maybe there is a tool that sends some packets like handshakes and get those data
    – storm
    Sep 9, 2015 at 10:56
  • 4
    @AhmedJerbi Generally unlikely, as make/model information is fairly irrelevant to pre-auth communications. There might be some other way you could "fingerprint" it, but such things tend to be error-prone and building proper fingerprinting signatures requires a lot of research and testing.
    – Iszi
    Sep 9, 2015 at 14:48
  • 2
    Essentially, the only way I'd expect you can get the AP make/model without connecting is if they're operating without WiFi encryption (or using weak encryption) and you happen to catch someone using the admin page via HTTP over WiFi. More APs are coming with WiFi encryption and HTTPS web interfaces enabled out of the box these days, so your opportunities for this are limited and becoming more so by the day.
    – Iszi
    Sep 9, 2015 at 14:50
  • If you only have that information then NO it is not possible. If the wifi you might be able to get it through dumb luck if the user visits the admin page from the wifi side, but not otherwise. If you contacted every single vendor and you got them to handover a list of every MAC and model associated with it, but good luck with that. Then it could still be spoofed,but most people don't bother.
    – cybernard
    Sep 18, 2015 at 0:26

3 Answers 3


If it's using WEP you can try to crack it and sniff a DNS traffic. That's why : almost all AP's have a DNS proxy functionality, and it's frequently in use. Do you can try to detect a DNS server version build and by fingerprinting it with MAC-guessed vendor and firmware image you can obtain some matches. The same one can be used with DHCP. But I don't think that AP's in infrastructure mode will have it enabled : usually in properly configured networks wireless clients are just pumped into VLAN and are talking to central DHCP, DNS and other services.

  • 1
    I seriously hope he's talking about his own AP here...
    – Potaito
    Apr 19, 2016 at 16:13

Surely in order to identify AP's vendor name, you can see the BSSID (the AP MAC address) and you can use an utility to search for the MAC address OUI (for example http://aruljohn.com/mac.pl). You mustn't connect to a wireless network to find out the BSSID. Simply you can scan a wireless network by using the Kismet application or the iwlist Linux command.

  • 3
    Some of the AP's support MAC adress cloning. If this function was used on the router, this utility will be useless.
    – Vilican
    Sep 9, 2015 at 13:55
  • 1
    Thanks for the answer but this method is not what i'm looking for firstly cause it gives only the brand name and not the model and also because the mac address can be changed so you can't track the device with mac lookup tools anymore .
    – storm
    Sep 9, 2015 at 13:59

Try Fing app wifi scanner or 3wifi database

And about the wps part you can find the router model of wps enabled network using wps scan tool in linux

Or wifi info view on windows.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .