Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to uniquely identify all wireless devices (phones, tablets, etc) within range. I don't care how far the devices are nor do I need to send them anything. I just want to be able to say: phone ABC was in this zone between 9:00 - 9:30, and 17:00 - 18:00.

I was thinking of sniffing Wifi packets but it seems that some phones avoid sending Probe Request packets, furthermore it's difficult to get Wifi cards into Monitor Mode. I've been unable to find any information on EDGE/3G detection.

I'm trying to do something similar to

The approach must "uniquely identify" the device. Meaning I want to be able to differentiate between the same device entering the zone multiple times versus new devices entering.

The approach must collect "anonymous" data, meaning I don't want to record any information that would allow someone to figure out the owner's identity.

What's the best way to detect the presence of mobile devices?

share|improve this question

closed as off topic by Ƭᴇcʜιᴇ007, 8088, Nifle, ChrisF, studiohack Jan 6 '12 at 22:14

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

If for any reason they broadcast their MAC address (ie, arp requests), you can log that via tcpdump or router logs and even look up the brand of phone if desired. That however will only work on devices that actually attempt to connect. For any device that does not attempt to connect to anything, you are probably out of luck – MaQleod Sep 13 '11 at 20:49
I don't think there's any good way to do this for devices that aren't actively connecting to WiFi. You could potentially eavesdrop on their cellular signal to catch a unique ID, but this is probably illegal and would require relatively expensive equipment. – jcrawfordor Sep 13 '11 at 22:03
Does it not seem contradictory to be able to uniquely identify a given device and also keep anonymous data? Any data that is unique to a person, combined with additional information (e.g. CCTV data) can be used to uniquely identify a person, with geolocation data being particularly bad. As an example, see the AOL Search Data Release controversy: – Lukasa Sep 17 '11 at 13:21
@Lukasa: not necessarily. I might record MAC addresses of phones walking by my office but I have no way of measuring their "distance", which way they are walking, or if they ever come back a second time. Nor do I have (or plan to have) access to CCTV data. Ideally, I'd read their MAC address and store hash(MAC) to disk, making it impossible for someone to retrieve the actual MAC address at a later date. – Gili Sep 17 '11 at 17:37
@Gili: Hmm, yeah, I guess. Given sufficient data or enough motivation on the behalf of someone who wanted to use that data, that wouldn't cut it, but you can certainly make it harder. I retract my concern. =) – Lukasa Sep 17 '11 at 17:54
up vote 1 down vote accepted

Let's first rule out Bluetooth or GSM/CDMA and focus only on 802.11 communications. First, we are assuming that these devices are on and are set to look for a WiFi connection (actively probing) or that they are connected to another network and therefore there is traffic. Using a tool like airodump-ng or similar in monitor mode, you can pick up all the transmissions. Netstumbler and others that aren't truly in monitor mode may not pick up all WiFi traffic. Note that not all cards can go into monitor mode.

You could look into a wireless intrusion prevention system, which is looking for unauthorized WiFi activity. You could also setup a soft-ap as a honeypot and monitor connection or probes against it.

If a node is not transmitting and is not responding to any type of request broadcast over the network, then they don't exist for this scenario. There is no way to broadcast a magic packet that turns on WiFi unless perhaps the device is a 3G/CDMA data device which when it receives no signal falls back on WiFi.

share|improve this answer
Are you sure that most phones actively probe for networks? What defaults does Android and iPhone ship with? PS, I've updated the question. – Gili Sep 14 '11 at 14:06
If wifi is enabled they might, I can't tell you for sure on any of these systems (I only have a droid and never turn on wifi), as for the switch to WiFi, I think a program like Tasker might do that - but its certainly not a default behavior. – Eric G Sep 14 '11 at 14:36

Not the answer you're looking for? Browse other questions tagged .