Multi AP Wifi Network: Get list of connections on particular access point

3

1

My university maintains a wifi network with the same SSID throughout campus. Obviously, this network uses several routers. I am curious if it is possible to count the connections to a specific router. I have tried several common network scanning utilities (arp-scan, arp, nmap) but these appear to give the results about the entire network as the results do not change when I scan from different locations.

Is this information I can access? Thanks!

user3167101

Posted 2019-09-21T04:17:51.457

Reputation: 33

2If the Administrator configured the network properly you wouldn’t be able to tell the difference between individual access points. It’s very unlikely the network is using “routers” but instead enterprise equipment for the exact purpose you describe – Ramhound – 2019-09-21T04:30:21.893

@Ramhound Yes you are right, I guess those are not actually routers but access points. Too bad! Thanks! – user3167101 – 2019-09-21T17:09:19.643

@Tim_Stewart I mean the latter. How many clients are connected to a single AP wirelessly. My goal is to estimate the crowdedness of different areas of campus to choose where to study. – user3167101 – 2019-09-24T03:13:10.973

@Tim_Stewart MacOS Mojave – user3167101 – 2019-09-25T01:52:25.530

@Tim_Stewart I have access to other OS's if need be. It seems like you think it may be possible. Even if you are not sure, is there anything you would suggest looking into to continue researching? – user3167101 – 2019-09-25T20:38:33.150

Let me know if/where you run into trouble – Tim_Stewart – 2019-09-25T21:56:03.253

"My goal is to estimate the crowdedness of different areas of campus to choose where to study." Is this because you're trying to find a place with the best WiFi performance or just find the quietest place to study? Even if you could see how many wireless clients are connected to a particular AP, which you probably can't, this doesn't really sound like the best way to decide where to study! (XY question) – Mr Ethernet – 2019-09-27T23:24:17.350

@wrecclesham, lol you can... if you don't believe it. Try making a bootable USB yourself and follow the instructions on your own wireless network. – Tim_Stewart – 2019-09-28T23:36:37.660

Interesting. I'll try it myself! – Mr Ethernet – 2019-09-29T01:19:33.163

Answers

1

Yep, it's definitely possible. (Ubuntu, Debian, Kali) you used to be able to do it in windows with netstumbler but I don't think it's very well supported anymore. You can accomplish what you want with the aircrack-ng suite. Making a bootable USB is probably the best way to go in your case. I would recommend Kali, because it has everything pre-installed in the image. From the terminal use "airmon-ng start wlan0" (or whatever your card is named, ifconfig will show you) to put your card in monitor mode. Do a "airodump-ng wlanXmon" (where x is the number that airmon-ng outputted for the monitor interface it created.) from the terminal, this will scan through all the channels, stop it with Ctrl+z when you find your target.Then "airodump-ng -c x --bssid xx:xx:xx:xx:xx:xx wlan0mon" fill in the X's, with the channel you found it broadcasting on, and the Mac address of the target AP. It will then show you only that targeted AP, and all the clients that are associated with it on that channel.

Tim_Stewart

Posted 2019-09-21T04:17:51.457

Reputation: 3 983

I am having a little trouble getting a linux box long term, but all signs point to this working! Thank you for your help! – user3167101 – 2019-09-27T20:27:48.150

You are welcome! – Tim_Stewart – 2019-09-27T20:30:56.787

Asked: 2019-09-21T04:17:51.457

Viewed: 104 times

Active: 2019-11-28T21:40:49.963