Ask Your Question

How to detect packets only from devices connected to my wifi

asked 2018-03-03 11:14:15 +0000

kootenpv gravatar image

I'm interested in finding out if there is something in one of the fields that can tell me "this device is connected to my wifi" (or not). Does anyone know which field might indicate this? I would actually not like to limit the search to my wifi only, but just to know where to look in the output.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-03-03 12:15:28 +0000

Bob Jones gravatar image

updated 2018-03-03 14:13:47 +0000

This would be the BSSID field. Match up the BSSID fields for YOUR network(s), perhaps by matching SSID parameter in a beacon or probe response as the SSID parameter likely has your network name; it is possible to hide this but for most home networks it is visible in the trace. There are other ways to get it if needed.

Once you have the SSID/BSSID matching (highlighted in a beacon below) then you can use a display filter for just this BSSID, as in

wlan.bssid == <mac address>

for example

wlan.bssid == 00:11:22:33:44:55

It is possible to do a capture filter for just a specific BSSID but that is often problematic, depending on what you need. Not all frames in use contain this field, so by filtering on it at capture, you may miss traffic that you really want. Until you are sure of the specifics of this behavior, I suggest capturing everything and then use a display filter.

Frame 10: 247 bytes on wire (1976 bits), 247 bytes captured (1976 bits) on interface 0
Radiotap Header v0, Length 25
802.11 radio information
IEEE 802.11 Beacon frame, Flags: ........C
    Type/Subtype: Beacon frame (0x0008)
    Frame Control Field: 0x8000
    .000 0000 0000 0000 = Duration: 0 microseconds
    Receiver address: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination address: Broadcast (ff:ff:ff:ff:ff:ff)
    Transmitter address: Pegatron_9a:10:8a (0c:54:a5:9a:10:8a)
    Source address: Pegatron_9a:10:8a (0c:54:a5:9a:10:8a)
    BSS Id: Pegatron_9a:10:8a (0c:54:a5:9a:10:8a)                    <-----BSSID for this network
    .... .... .... 0000 = Fragment number: 0
    1000 1001 0111 .... = Sequence number: 2199
    Frame check sequence: 0xb61b59f0 [correct]
    [FCS Status: Good]
IEEE 802.11 wireless LAN
    Fixed parameters (12 bytes)
    Tagged parameters (182 bytes)
        Tag: SSID parameter set: xfinitywifi                    <-----SSID for this network
        Tag: Supported Rates 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/sec]
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-03-03 11:14:15 +0000

Seen: 4,876 times

Last updated: Mar 03 '18