 | 1 | initial version |
This could be done by picking up the probes that devices usually send out when looking for new networks to connect to. These would typically be broadcast probe requests. A filter to see probe requests might be
wlan.fc.type_subtype == 0x04
I could imagine a filter for signal strength as well (i.e. above a specific level) to be sure they are in your particular location.
Note that some systems attempt to randomize MAC addresses which in some ways could reduce the value of your information. See, for example (and google...)
https://ido2016.sciencesconf.org/122873/document
However, I suppose ANY frame sent from a client that is within range is something you want to pick up; so you are not dependent probes.
Did you have a look at what these guys do? Maybe they have a cost effective solution?
https://www.pwnieexpress.com/network-asset-discovery
Maybe the aircrack-ng suite of utilities or even kismet would be better than Wireshark for this task; they may do some 'packaging' of the data to make it easier to consume.
