Everyone, thanks for coming back to Wi Fi fundamentals which location and analytics. This course will help you to master the air. we're advancing and in part one we have said that every station has its own unique identifier, a unique identifier that can be tracked. Let's dive in. Our smartphone has its own unique signature. It is made of the MAC address, its physical hardware address, the our society's signal strength and the time spent at the location.
Let's look at probe requests in Wireshark. Again, I have a probe request that was sent from this source to the breakfast destination address is actually asking what network is available on that channel. Which channel we can see in the information elements that its current channel is 12. It sends the request, waits a while. If it doesn't hear anything, it goes to another channel and sends the probe request again. As I said, it is sent to the broadcast destination address so everyone can hear it.
It's SSID value is set to zero. So what is the now probe request? So a probe request is a management frame that is sent either to a broadcast domain denial probe request, or to an already known SSH. The direct probe request. Once sent, the station waits a short time to see if an answer arrived. If not, it moves to another channel and repeat the discovery probe, including its own device capabilities.
One thing to notice probe requests are not so predicted as beacon frame. They're actually sent in burst stations probe differently when they move rather than being static, pre and post Association when they have different number of known SS IDs. When they reach the cell edge if they're connected to an access point, when they go to sleep, they probe less frequently to save battery life. 11 standard does not impose a broadcasting frequency, the interval between a probe to the other detached pie shows a probe request capture that I have made during one minute. As can be seen, my LG device probes most of the time, while others problem is MAC address is a key part of the probe request. It is shown in the transmitter address field, as we saw earlier in Wireshark.
And there are six bytes long 48 bit hexadecimal numbers embedded in your wireless card. Every network adapter will have a unique MAC address, and even every SSID in your access point will have a different MAC address. Even if you have multiple FSA IDs on the same radio Some vendors will use the first three bytes as an identifier for their company. It is called and only. MAC addresses are used as the unique identifier for a station, or a person holding a smartphone, which is its own station. Let's have a look at MAC addresses in Wireshark.
Back to our capture, we can see that we have an Apple device that sends a probe request. We can see in the last three bytes, but if we look at the transmitter address, we can see that it's full MAC address is 7831 c one, Ca e4 and E eight. Let's have a look at them all we look up tool from Wireshark To see if 7831 and C one belongs to Apple 7831 and C 131 and C one, the first three bytes. That's fine. And Yep, it's an Apple device. for privacy reasons, iPhones and some Android phones are randomizing their MAC address periodically while they're in a de associating states.
When associating to an access point they return to use their global MAC address. MAC address randomization can be hacked through different attacks, and other options. As we will see. vendors that wish to use the render MAC addresses must register to the I triple E MAC address block large. Random MAC addresses can be recognized since they will correspond to the unassigned MAC address rules. We can identify randomization, but we can track it over time.
In Android, we do see a pattern of sending randomize the MAC address in conjunction with its own global MAC address. It seems that Samsung one of androids biggest vendors, doesn't randomize its MAC address. That's a screenshot I took from my phone. Look at the MAC address 30 07 44 b FEC and that's a screenshot I took in Wireshark the same MAC address. Next up Cross checks. We will see how we can get over the Mac randomization.
See you soon