0

If using tcpdump to monitor a wireless interface and listen on a specific channel for traffic associated with a BSSID, how can I display information (e.g. mac address) about any connected clients?

The following command can capture beacon packets:

tcpdump "type mgt subtype beacon and ether src $BSSID" -I -c200 -i en1 -vv

Is it possible to alter the type and subtype and display connected clients?

tcpdump version is 4.9.3 on MacOS - airmon and airodump do not work on that platform and airport sniff only seems to write cap files.

2
  • This might help: wireshark display filters
    – JonnieJS
    Jan 5, 2020 at 12:41
  • The connected clients are only know to the Wifi access point. Therefore if you don't want to sniff the data you need to query the AP itself and get the data from it. As such queries are not standardized (or the existence of an API at all) you have to check the documentation of your Wifi AP.
    – Robert
    Jan 5, 2020 at 15:04

1 Answer 1

0

An AP will only send data frames to, and accept data frames from, connected clients. So capture data frames. If you see a FromDS data frame from your AP's MAC address (BSSID) to a certain MAC address, you know that that client is connected (or at least that the AP had not yet realized the client was gone). If you see a ToDS data frame to your BSSID, and it is not quickly followed with a deauth from the AP, then you know the client that sent that data frame was connected when it sent it.

There is no sure way to know if there may be other clients connected, that just happen to be idle or you didn't manage to capture any packet to/from them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .