I was able to locate my device using horst on Linux. Other responses show how to triangulate, but not how to get the actual signal strength. horst
can do that, and perhaps kismet
, too.
First, run horst pointing to your wireless LAN adapter: horst -i wlan0
. Then hit e
to go to the ESSID
screen and find your network. horst
will find a bunch of devices from your neighbors, so you need to start filtering. From the ESSID
screen, you can get the BSSID
value for your network (the value within parenthesis) and restart with that filter: horst -i wlan0 -B xx:xx:xx:xx:xx:xx
(of course, replace the xx
with your actual BSSID).
horst
should be showing now only your devices. You can now sort the list by signal strength (o
then s
), and walk around your house with your laptop, and see as the signal increases or decreases. The values are in dBm, so look for the number to increase (-25
is closer than -50
).
If you're not sure which of the devices shown is your target, you have a few options. The simplest is to just switch down everything else: computers, tablets, phones and printers (I always forget the printer and keep wondering who's tied into my network). Another option is to run nmap
on your network, and see if you can figure out which one is your target by looking at the provided information (for example, manufacturer can be shown, sometimes, given the MAC).
Once you determine which one is your device, you can restart with -e
to look specifically at it: horst -i wlan0 -e xx:xx:xx:xx:xx:xx
.
horst
will only update the strength of the signal on the screen as the device sees traffic, though. You can try pinging it or talking to it (sending WhatsApp messages, for example). In my case, as I had already used nmap
to find its IP and MAC, I found it easier to just put nmap
on a loop scanning it (as ping would not do): while true; do nmap 192.168.0.10; done
generated a fair amount of traffic to the IP, that allowed me to locate it just by walking around and looking at the signal strength. If you can't generate traffic on it, then perhaps you'll have to go the triangulation way.
airodump-ng
(part of theaircrack-ng
tool suite) if you have a compatible Wifi card and a Linux distro up and running. You'll see something like this with the signal reception listed asPWR
(in decibels). If you keep pinging the device throughout this, you should see theairodump-ng
screen update much quicker with the MAC address of the device. You should then be able to move around with your laptop, trying to increase thePWR
until you find the device.