Library to track wi-fi sources (cell phones) (wardrive reversed)

[Kapiau]

Hello all,

I've been looking for a way to setup a few wifi antenas in listening mode, capture "events" with Kismet then compile the information to give me with some idea of how many wifi devices were in the area as well as have some indication of their locations.

To to that I expect the algorithm to do pretty much the reverse of a Wardrive. I imanine 3 or more wifi devices in listening mode. Each one of them with a GPS location. They would, using Kismet, log MAC addresses, with power level and time stamp. An algorithm would get the 3 GPS locations, get each of the MAC addresses, try to match time stamps and interpolate/triangulate positions. I've seen results of such algorithms that track crowds as well as individuals. However, I haven't been able to find a library that does that.

I hope there are some knowledgeable folks out there who know where should I be looking.

[cooper]

Well, there first was this discussion here but it went off in a different direction. It should provide you with some insight at least. After that you're pretty much on your own as I don't believe any library currently exists that does what you want. So the question now becomes: how capable do you think you are to make such an idea work?

[Kapiau]

Hallo Cooper,
Thank you very much for your reply. I saw how you and toughbunny discussed hard on the topic and indeed it drifted a bit as you were doing for the sake of the experirment. In my case, I have a more specific question and I know it is pretty straight forward.

Additionally, based on my research on the topic, I would be really surprised if nobody ever built anything like that.

Thus it is, in my opinion, not a matter of capability, but of knowledge of projects and technologies. I'm trying really hard to avoid reinventing the wheel and hope to find some folks who know the tricks to get the job done!

[Kapiau]

Here are a few projects that people put together to do something similar to what I'm looking for:
http://mw2013.museumsandtheweb.com/paper/3817/

http://atrf.info/papers/2013/2013_abedi_bhaskar_chung.pdf

[vailixi]

I know you can log MAC addresses along with the manuafacturer information with airdump-ng. You can also log the GPS information. It's a one liner you can run from terminal but I can't remember it right off hand.

[cooper]

You can only log your own GPS info obviously. It's how Wigle (or whatever it's called) does its thing. The point is to try and triangulate somehow where the transmitter is located without relying on it to tell you (as you can't trust it to be truthful even if it did tell you, which it doesn't).

[barry99705]

You can only log your own GPS info obviously. It's how Wigle (or whatever it's called) does its thing. The point is to try and triangulate somehow where the transmitter is located without relying on it to tell you (as you can't trust it to be truthful even if it did tell you, which it doesn't).

Pretty sure kismet drones can log their gps coordinates. The biggest problem is going to be timing. The clocks on your wireless location devices have to be synchronized, and very accurate. If the timing is off, then the location from the triangulation is going to be off. That's usually part of why commercial systems cost so damn much.

[Kapiau]

Yes, synchronization would be ideal. However, keep in mind this is to identify people with phones in their pockets walking on a sidewalk. From the GPS signal of my 3+ locations I'll get also accurate timing. By getting power readings that are "close" I expect to have some error indeed, but that should be well within the accuracy of the power readings anyway.

Having that said, this discussion seems to slowly confirm my fears that there is no ready solution for my problem. Is that so?

[barry99705]

No, there isn't, unless you want to spend a shit-ton of money.

[oddsight]

Hello all,

I've been looking for a way to setup a few wifi antenas in listening mode, capture "events" with Kismet then compile the information to give me with some idea of how many wifi devices were in the area as well as have some indication of their locations.

To to that I expect the algorithm to do pretty much the reverse of a Wardrive. I imanine 3 or more wifi devices in listening mode. Each one of them with a GPS location. They would, using Kismet, log MAC addresses, with power level and time stamp. An algorithm would get the 3 GPS locations, get each of the MAC addresses, try to match time stamps and interpolate/triangulate positions. I've seen results of such algorithms that track crowds as well as individuals. However, I haven't been able to find a library that does that.

I hope there are some knowledgeable folks out there who know where should I be looking.

well I'm not really sure if what I'm about to suggest is even possible but you could set up 3 or 4 war-drive (war-camping?) stations and workout a person's location from the overlap. You wouldn't be able to tie them directly to a GPS location but you might be able to get an approximation.

I made a pretty picture:

Like I said no GPS coords and there would be blind spots for sure. You may have to calibrate the areas where coverage overlaps by physically walking the target areas and tracking yourself. Even then, you may not have very accurate readings.

I think you could probably figure something out, it would just take a lot of time, money and effort. Or I could be completely wrong - I honestly don't know.

[barry99705]

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/WiFiLBS-DG/wifich2.html