Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it?

Sniffing packets with Wireshark or other does not give any info , but I remembre once using a tool like reaver I saw my AP model (I was cracking it) in output.

Is there any network reconnaissance packet I can send to the PA that do the job ? How did reaver detected my AP model.

  • You can get the some information (brand) using tools like "MAC Address Lookup", try seaching on google. – G4spr Sep 9 '15 at 10:48
  • 1
    It's not about MAC lookup tools as mac address can be easily changed I want to know the exact informations maybe there is a tool that sends some packets like handshakes and get those data – storm Sep 9 '15 at 10:56
  • 4
    @AhmedJerbi Generally unlikely, as make/model information is fairly irrelevant to pre-auth communications. There might be some other way you could "fingerprint" it, but such things tend to be error-prone and building proper fingerprinting signatures requires a lot of research and testing. – Iszi Sep 9 '15 at 14:48
  • 2
    Essentially, the only way I'd expect you can get the AP make/model without connecting is if they're operating without WiFi encryption (or using weak encryption) and you happen to catch someone using the admin page via HTTP over WiFi. More APs are coming with WiFi encryption and HTTPS web interfaces enabled out of the box these days, so your opportunities for this are limited and becoming more so by the day. – Iszi Sep 9 '15 at 14:50
  • If you only have that information then NO it is not possible. If the wifi you might be able to get it through dumb luck if the user visits the admin page from the wifi side, but not otherwise. If you contacted every single vendor and you got them to handover a list of every MAC and model associated with it, but good luck with that. Then it could still be spoofed,but most people don't bother. – cybernard Sep 18 '15 at 0:26

If it's using WEP you can try to crack it and sniff a DNS traffic. That's why : almost all AP's have a DNS proxy functionality, and it's frequently in use. Do you can try to detect a DNS server version build and by fingerprinting it with MAC-guessed vendor and firmware image you can obtain some matches. The same one can be used with DHCP. But I don't think that AP's in infrastructure mode will have it enabled : usually in properly configured networks wireless clients are just pumped into VLAN and are talking to central DHCP, DNS and other services.

  • 1
    I seriously hope he's talking about his own AP here... – Potaito Apr 19 '16 at 16:13

Surely in order to identify AP's vendor name, you can see the BSSID (the AP MAC address) and you can use an utility to search for the MAC address OUI (for example http://aruljohn.com/mac.pl). You mustn't connect to a wireless network to find out the BSSID. Simply you can scan a wireless network by using the Kismet application or the iwlist Linux command.

  • 3
    Some of the AP's support MAC adress cloning. If this function was used on the router, this utility will be useless. – Vilican Sep 9 '15 at 13:55
  • 1
    Thanks for the answer but this method is not what i'm looking for firstly cause it gives only the brand name and not the model and also because the mac address can be changed so you can't track the device with mac lookup tools anymore . – storm Sep 9 '15 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.