This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Detecting MAC of devices not connected to wireless network

0

Is there a way to use Wireshark to detect MAC id's of devices not connected to a wireless network? If so, how would you set it do achieve this goal?

asked 21 Aug '16, 13:12

harlev's gravatar image

harlev
6112
accept rate: 0%

Not enough information about what you really want.

If you mean MAC addresses of devices in the same IP subnet which is used on your wireless interface, nothing special is required, just capture the ARP requests (which are broadcast) for long enough time, or to speed it up, use a script to ping each address in the subnet once (which will make your PC send an ARP request and receive an ARP response from each device) and you should catch them all.

If you mean MAC addresses outside your wireless interface's subnet, there is no way to capture them on your wireless interface, and you'll need to use a wired one to connect to the (V)LAN where these devices are connected, and use the same method as above.

If you do not have physical access to the LAN hosting the subnet which those devices use, you're out of luck.

(21 Aug '16, 13:45) sindy

Not sure what you really want, but you can likely get MAC addresses of nearby wireless devices if you are able to capture traffic with a wifi interface in monitor+promsicuous mode. You would see those packets if they are nearby (and your interface can decode them) and they are attached to another network, but even if they are not, you might get lucky and see them probe for configured networks. Those probe requests will tell you lots about the devices around you.

This last point meets your requirements: observe MAC addresses of wireless devices not connected to any wireless network. I can think of nefarious uses for this: track devices as they move around. Probably what the NSA does.

Check out www.aircrack-ng.org as well.

(21 Aug '16, 13:58) Bob Jones

Yes, I would like to see devices probe for networks, but all I need is their MAC address. How can I configure Wireshark to do this?

I was looking at aircrack-ng but was hoping Wireshark could provide more granular information

(21 Aug '16, 15:02) harlev

One Answer:

0

Try here to get started capturing wifi packets:

CaptureSetup/WLAN - The Wireshark Wiki https://wiki.wireshark.org/CaptureSetup/WLAN

This will definetly be more granular, maybe too much. You can filter for probes when you get to that point.

answered 21 Aug '16, 16:26

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%