search

schollz / howmanypeoplearearound

Count the number of people around you :family_man_man_boy: by monitoring wifi signals :satellite:
MIT License
6.91k stars 385 forks source link

Frequency hopping #30

Open Y0Username opened 7 years ago

Y0Username commented 7 years ago

Hey! Nice work! I have actually used your find-lf code to develop my own verison of howmanypeoplearearound.

It is ofcourse hard to track un-associated MAC addresses because of MAC address randomizaition. A solution to this could be, we can tack the known SSID list a particular device sends and then we can map the randomized MACs to be the same?

Another main issue I have faced is frquency hopping. I don't think tshark hops frequncies to find the devices in all the channels. I think airodump-ng does this. I'm trying to implement that.

schollz commented 7 years ago

A solution to this could be, we can tack the known SSID list a particular device sends and then we can map the randomized MACs to be the same?

I'm not sure I understand - do you mean to test various devices to see what kind of random MACs they send out and then map these back? That seems awfully labor intensive (not to mention you'd have to get your hands on a lot of phones).

I think airodump-ng does this

That'd be awesome to get something working with airodump-ng! Please let me know if you do, I'd love to incorporate it into this and also find-lf!

Y0Username commented 7 years ago

No I did not mean to say populate the list of random MACs for each devices.

What is meant to say is: Expoilting the active scan. Phones are sending probe request to list of all the SSIDs they have been ever connected to. Based on this list of SSIDs they send probes requests to, we can identify the spoofed MACs. If two MACs send the active probe request to same set of SSIDs, they are they same device, spoofing the MAC.

schollz commented 7 years ago

@Y0Username I see! That is very clever!

prabodh1194 commented 7 years ago

This looks really interesting. Adding another field to tshark parser "-e _ws.col.Info" also gives us an SSID of wifi. Will it help to parse this field too?

allnash commented 6 years ago

I have a similar technique implemented.

Here is a cheatsheet to the list of filters.

https://www.semfionetworks.com/uploads/2/9/8/3/29831147/wireshark_802.11_filters_-_reference_sheet.pdf