Tracking unassociated WiFi clients

[tommyq]

Hi. I'm trying to devise a means to quite literally find a phone - perhaps in a field etc.  I can see with various tools some makes of phones and even detect how far away they are by seeing the signal strength. However, some phones appear to be silent or perhaps are using random MACs?  In my use case I wont know the MAC address of the phone so all I need is to know there is one and how far away it is.  I appreciate the range is limited, but thats fine. I've seen old and newish Samsung phones get detected while out of range from their APs. Equally, I've seen Huawei not. What happens for the ones that cant be detected away from their home AP is that as they come in range, I suddenly see them.  This is with the likes of airodump-ng, kismet, and from gitgub trackerjacker.  On the Tetra, I cant see this 2nd class of phone with Recon, signal strength or site survey modules.   I'd tried to use the Tetra with the likes of airodump-ng in parallel to get get the Tetra to respond to probe requests.  My assumption if the phone isn't using random MACs is that it is in fact silent until the AP reaches out 1st.

 

Does anybody have any thoughts or way of detecting such devices.  My remaining idea is to simply try to detect any 2.4G signals emanating from the phones.

Thanks.

[Irukandji]

But I don't know if it is one.

[tommyq]

Why its spam, and why its inappropriate?  For the problem I described, I had hoped to use the Tetra or Nano. The question is very much about recon/beaconing and signal strength.  (PineAP, Recon, Site Survey) Isnt that in part what the Hak5 kit is about and a forum where you can ask for pointers? 

If you could be a little more helpful at least as to where you think this should go, I'll gladly oblige.  Polite answers please.  😞 

[Bigbiz]

Load airodump-ng

[tommyq]

5 hours ago, Bigbiz said:

Load airodump-ng

Hi.  Thanks for your reply.  Appreciated. I'd trued airodump-ng though not on the Tetra.  It doesn't seem to see everything and same for Kismet. From what I've observed and read, it seems there is passive and active scanning between APs and stations.  In the passive case, I think the phone is totally silent in this respect until it sees a beacon it recognises from the AP.  IF I'm right, then I cant even tell there on WiFi channels let alone any signal strength.  Am I missing something? 

My Samsung phones seem to beacon out in the active mode. Huawei and OnePlus just sit there until they get in range of their expected AP. If thats the case, then I could look for signalling back to the cell tower. That wouldn't help locate a phone I dont think as the range is between 2 and 5 miles from phone to tower.  I need to home in on a specific device.    Tom.