My university maintains a wifi network with the same SSID throughout campus. Obviously, this network uses several routers. I am curious if it is possible to count the connections to a specific router. I have tried several common network scanning utilities (arp-scan, arp, nmap) but these appear to give the results about the entire network as the results do not change when I scan from different locations.

Is this information I can access? Thanks!

  • 2
    If the Administrator configured the network properly you wouldn’t be able to tell the difference between individual access points. It’s very unlikely the network is using “routers” but instead enterprise equipment for the exact purpose you describe – Ramhound Sep 21 '19 at 4:30
  • @Ramhound Yes you are right, I guess those are not actually routers but access points. Too bad! Thanks! – user3167101 Sep 21 '19 at 17:09
  • @Tim_Stewart I mean the latter. How many clients are connected to a single AP wirelessly. My goal is to estimate the crowdedness of different areas of campus to choose where to study. – user3167101 Sep 24 '19 at 3:13
  • @Tim_Stewart MacOS Mojave – user3167101 Sep 25 '19 at 1:52
  • @Tim_Stewart I have access to other OS's if need be. It seems like you think it may be possible. Even if you are not sure, is there anything you would suggest looking into to continue researching? – user3167101 Sep 25 '19 at 20:38

Yep, it's definitely possible. (Ubuntu, Debian, Kali) you used to be able to do it in windows with netstumbler but I don't think it's very well supported anymore. You can accomplish what you want with the aircrack-ng suite. Making a bootable USB is probably the best way to go in your case. I would recommend Kali, because it has everything pre-installed in the image. From the terminal use "airmon-ng start wlan0" (or whatever your card is named, ifconfig will show you) to put your card in monitor mode. Do a "airodump-ng wlanXmon" (where x is the number that airmon-ng outputted for the monitor interface it created.) from the terminal, this will scan through all the channels, stop it with Ctrl+z when you find your target.Then "airodump-ng -c x --bssid xx:xx:xx:xx:xx:xx wlan0mon" fill in the X's, with the channel you found it broadcasting on, and the Mac address of the target AP. It will then show you only that targeted AP, and all the clients that are associated with it on that channel.

| improve this answer | |
  • I am having a little trouble getting a linux box long term, but all signs point to this working! Thank you for your help! – user3167101 Sep 27 '19 at 20:27
  • You are welcome! 👍 – Tim_Stewart Sep 27 '19 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.