Ask Your Question

get active users from pcap file

asked 2018-03-06 14:57:36 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

After capture wireless traffic to pcap file, what filter should I apply to get the list of active users connected to an access point?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-03-06 23:34:18 +0000

Bob Jones gravatar image

The easiest answer is to use a managed wifi infrastructure and it will likely just tell you how many clients are currently connected to an AP and the whole system (if you have more than one AP). Sometimes, even standalone APs will tell about all the clients connected. This is a definitive source.

The harder way is to use a wireless packet capture. If you have a single SSID configured, find the BSSID and filter for this; the endpoints tool, with 'limit to display filter' and selecting for 802.11, is useful here.

See and also probably many other questions.

And for the Endpoints tool, see Statistics --> Endpoints

If you happen to have more than one SSID hosted on an AP, then it depends on what you want. If you only care about who is connected to a particular SSID, then the above is fine. If, as you ask, you want to know how many actual clients are connected to a given AP, regardless of SSID, then it can be tricky. There are techniques, but you have to figure out how your platform assigns BSSIDs to the various SSIDs - it's a common misconception that they all just change the last byte. Some do this, but certainly not all. Others change different bytes in the MAC address so we would have to reverse engineer this pattern, then work up some display filters that are consistent with these platforms.

edit flag offensive delete link more


Since I have only one AP (one bssid), when I use endpoint tool as you suggest and if I count the IPv4 the local addresses, is it the right way to get active users?

vserey gravatar imagevserey ( 2018-03-07 02:59:08 +0000 )edit

Before using the endpoint tool you would need to have a good filter in place, as in the linked question provided. The problem with IPs and WiFi is that they are usually encrypted; it is possible to run WiFi without encryption but it is generally a bad idea. But yes, if you are running unencrypted, then the IP address is a good indication of the number of clients connected.

If encrypted, you would be counting MAC addresses. Either way should be reasonable.

Bob Jones gravatar imageBob Jones ( 2018-03-07 10:40:43 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-03-06 14:57:36 +0000

Seen: 3,172 times

Last updated: Mar 06 '18