Andreas, many thanks for your informative videos. They are the best! Great works never stops. I especially liked this one. It sparks my interest.

Thanks Andreas. I had this scenario on my wish list, and your work here couldn't be a better fit !

I love this idea to extend my home automation system with. Thanks for that Andreas!

Outstanding, and very useful :) Thanks for doing such a comprehensive video on this sensor Andreas :)

Great article Andreas, it's one of the best you ever made! And I was exactly looking for something like this!

Brilliant! This can be modified to detect home owners and turn on/off lights etc.

I misread the video title and thought it was a boring video about listing access points. But since it was YOUR video, I decided to watch it anyway. I discovered that I was mistaken and enjoyed the topic. Great stuff as usual Andreas!

I would have never thought to use the chip like this. It's so simple, but at the same time an interesting and impressive role this simle WiFi module is playing. Using monitor mode for surveillance in this specific way is pretty clever. Respect

Now Intruders will start using Nokia 3310

I really like the voice speed now. Great improvement. And i also like the topic. Summary : BIG LIKE from Me :)

I had never thought such tracking or detection was possible with just wifi 😯 Nice work 👌

Fascinating, thank you. Very best wishes Arthur

well done, good explaination :) Andreas, why not publishing a basic node-red flow together with the supporting material? it can be useful, for sure...

Very interesting project. Thanks for sharing!

Another great idea!! now, combine this with your "TV faker" so that it turns on when you are not home and is off when you are.

Good morning! Great idea to add to my home security network. Thank you!

Thanks Andreas. Excellent video!

Awesome project. This is going on my list of future projects. I am wondering if an array (perhaps 3 or 4) of sensors distributed around the home might actually be used to detect which room in one's home one is situated (by comparing the various signal strengths). I carry my phone everywhere (it hangs from a lanyard around my neck) so this will fit into my life seamlessly. Thank you Andreas.

Very interesting video, thanks again Andreas!

Excellent commentary on these topics. Thank you

Fantastic project, thank you.

You deserve my like. It would be good to make a statistic script for it (device counting, decode manufacturera etc)

Thank you! so much love your videos! perfect and clear explanation

Hi Andreass, thanks for the great video. I would like to ask you a question. Can i do the same thing by using smartphone sharing hotspot? Thank you so much!

i turn off WIFI on my phone when going out, even when using GPS. (If GPS is difficult to get a lock on, i'll sometimes enable it when at home with WIFI enabled, then once it has a lock i disable wifi). People can figure out your home network SSID name, by packet sniffing your phone's wifi as it calls out to familiar SSIDs to see if they are there. Couple this with databases of GPS locations of SSIDs and you have a way of scanning any location, and pin-pointing the address of everyone's home, work, everywhere they've shopped, where their mistress lives, what union meetings they've attended, etc. (this is why your phone's GPS complains about no-wifi in the first place, all phones are automatic listening devices marking their local SSIDs to GPS coordinates and sending them to Apple/Google/etc to maintain the databases. Impressive stuff).

Hi Andreas, many thanks for the video. I also had a similar idea project and found you already did it ;) Now tricky question, if you use 3 device detectors and use the rssi with triangulation, maybe we can determine roughly the position/movements of the intruder ;)

Very interesting. Thanks for sharing !

I had a similar idea and tried it. Going over the data later, it looked like the numbers of the people during that time frame were inflated. Wasn't sure if this was because I was picking up smartphones from other buildings in our area or if the phones were randomizing their MAC Addresses or what. I wondered if I could filter on RSSI, but from my reading that can be all over the place due to a million different variables, so it's not a good way to calculate distance. Well, either was it's a fun project and it can show trends and such (what times of day there's a crowd). Cool video, I'm going to check out your other stuff too.

Hugely enjoy your videos

I am really proud of this module, it was designed by my friend's team in China, and it is very cheap in China, just 1 american dollar.

Andreas, Thanks for this. Would you mind adding the Node-Red flow to Github please. I'm still learning how to use Node-red and would profit from your running examples. Thanks

ESP32 has BT included... so another dimension.

You gave me a good laugh already at 1:13 soI already comment and give you a like ;-) Thanks for your video's

Excellent project. I've been using a ping to detect my cell phone on my wifi network in order to auto arm my blink system. I will investigate your approach because the iPhone regularly drops off wifi. My Android provides a reliable ping target.

Hey Andreas, awesome video! I’m considering using something similar to this for school in order to track the amount of people in different buildings to research peak times and such. Do you know an estimate of the distance which the esp8266 could would work from?

Very nice and complete post Andreas. I used this technique on an ESP8266 to detect which family members are at home, just like the Weasley clock from the Harry Potter books.

alsum given me something to think out like the idea thanks for taken the time to make it

Thanks for another very entertaining video. On the task of detecting human presence what about using our thermal signature? It would also detect the ones who forgot to bring their beloved WiFi emitting devices along. Panasonic makes an infrared sensor array (AMG8833) that could be used for such scenario. It can be found on Kris Winer´s Tindie shop or Adafruit.

Your videos go beyond temp sensors and the like. Will you ever make a step by step video of how this could be built?

Interesting video. I didn't know about Apple's MAC address gen. Thnxs !

Another good video. I have a special interest in this one since 4 years ago I thought about something similar to detect bandits. I was considering if it was possible to intercept the synchronization signal between a cell phone and the tower. It was just an idea I discussed with a few friends. Nothing more than that. I did not act on it at all due to the lack of detailed technical knowledge in the area and the high probability it was illegal. Your solution is more elegant but it does depend on wifi being on. Anyway its probably on on most persons phones.

As usual, very interesting and informative. It may also have solved a problem I encountered yesterday when I was in a shopping mall. I connected to their service but realized I was not connected to my VPN. I connected and after several minutes I was blocked from their network. I don't know much about this topic but based on this video I suspect that the VPN MAC address or some other aspect of the link was recognized and the system automagically blocked me. I will tinker wit his device and perhaps use it to geo-fence my home so that lights turn on or off if my phone approaches the house. Thanks again for a great video.

I have tried this but using mac address from ble tag, but having a dead end so far, your solution give me a new life. Thanks

Love the accent =) Tks again.

Hi Andreas Did you record the average current consumption for this? I'm thinking to make a solar powered version as an 'iminent bus arrival' detector and need to calculate the requirements using your other videos. Where I am, there is no api relating to public transport, but all the busses on this route do have WiFi access points, with a difference in the SSID for the local and long-distance services. I would extract only the ones I want and act upon them. Obviously, I'd remove the database part of the code. Thanks

I wonder if you could combine this with the idea of a WiFi Pineapple and just authorize any connection request a device puts out. Theoretically the device will transmit its genuine MAC address and boom, it has bypassed the OS's attempt to hide it. Very interesting stuff, been watching a lot of your videos and it's helped me understand more of the hardware world (coming from the software side it's great to see what is possible)

In the last two videos your voice has sounded like there's some kind of audio distortion on it. It has a sort of metallic sound.

Hi Andreas, thanks for the great video, i have a question. I would like to send all information (MAC, SSID, CHANNEL and RSSI) together to de MQTT. As it is shown at the start. Is that possible? if not, is it possible to send the SSID? Thank you

The method you are referring for breaking the MAC randomization requires to things: a) you know the HW MAC address of the device in advance (you can find out with that hack, that a randomized divice actually has a certain known HW MAC address) and b) you are able to send arbitrary RTS frames (IEEE 802.11 control frames). This is not allowed by the closed source driver of the ESP and I am not aware that anybody has managed to get around that.

Thanks for another excellent video. Your channel is a constant source of inspiration and an enthusiastic mentor encouraging us to step out of our comfort zone and push ourselves to higher places. For anyone struggling, I picked up some issues when I tried to upload the Github code: - In mqtt.h update mqttServer = "Your Broker IP address", - In WiFi_Sniffer set mySSID and MyPassword, - The github code starts on channel 7 and stops escapes at 8 but this is mentioned in the video and easy to change. - The mqtt topic is Sniffer. - If you have set-up a user and login for your mqtt broker update the sendDevices function in the Wifi_Sniffer to client.connect("ESP32Client", MQTT_USERNAME, MQTT_KEY ) in place of admin, admin. - I was getting a 'Not published' message on the Serial Monitor which I think is due to MQTT_MAX_PACKET_SIZE in the pubsubClient library. I added #define MQTT_MAX_PACKET_SIZE 256; in Wifi_Sniffer folder and it seems to be working. I hope that this is of help and not just things that I missed when watching the video. Thanks again.

Excellent!!

Great video!!! Any chance you have or know where to find the original code by Ray Burnette? That might make it easier for me to follow what's going on here. Thanks. Great stuff - Love your channel!!!

Thanks for sharing :-)

Amazing project, thank you very much for sharing this information. However the link to the ArduinoJson lib on your github page seems to be broken. I found ArduinoJson in arduino ide library manager, but which version did you use for this project?

I read the paper you linked, it looks like that attack doesn't fully defeat the MAC randomization. What it does is let you recognize a phone that is disconnected and using a random MAC, given that *you already know its real MAC*. So you could use it for filtering out devices that you know but are disconnected from WiFi, but not for identifying the real MAC address of unknown devices; you have to find out their real MAC address some other way before the attack works.

Thank you for sharing this project Andreas! What changes are necessary to port it to ESP32? It is possible doing this without a router (only with others ESP32)?

wieder ein sehr interessantes sonntag-morgen-Filmchen ! doch eine Frage zur Vergangenheit... in welchem Film ist das mit "// #include " erklärt also deren Aufbau / Inhalt ... ( habe es leider vergessen ).. muss es jetzt mal selber hier einführen. thanks n.

Hey Andreas Great video!, I was testing the BT functionality of the esp32 in order to send data on small packages without establishing a connection, but due to the early development of the software Im still using esp8266. A long time ago I tested the esp8266 deauthorizer to force the esp to send specific packages... now I see this video, and I wonder... Is it possible ( well, everything is possible... I mean,,,, ), Do you see any advantage of using a esp8266 to encode specific packages like the bad deautorizer frames but with sensor data, and use this sketch to receive those frames ? By doing this i think is possible to emulate a "kind of" ble network, where one device is listening to a specific chanel / frame header, and the other device just send that frame+payload and goes back to sleep... I imagine this will be much faster than establishing a 2 point wifi connection, and you have the mac of the sender as a validation... I see an advantage of this topology in order to make a beacon network that consume less power... what do you think ?

You can also weaken the protection offered by MAC randomisation by using multiple detectors with a known and fixed geometric relationship which allows the random MACs to be clustered using triangulation from the different signal strengths.

Great project, and beautiful structured code with high educational value! Do you know if anyone already adapted this for use with the ESP32? Otherwise I might give it a go... About the MAC randomization: If you want better "enemy" detection, it's possible to partially bypass this issue by using the principle of an "evil twin" AP and exploiting the fact that many companies offer free WiFi acces for the exact same reason. If you setup your ESP to function as an acces point without password and an SSID with the same name as a popular public WiFi network like from airports or fastfood chains, then most devices that have used that network before will automatically trust and connect to your fake AP. And of course you can increase the chances of devices that connect by adding more ESP's with different common SSID.s HOWEVER, I'm not 100% sure if this method is fully legal. You're not gathering any personal data this way, but it does give the possibility to target and track individual devices that are not your own, so there might be some rules against it depending on where you live.

thank you!!! ;)

0:04 It's my photo(ESP8266 01) into you preview, that nice

i have heard about a project done using wifi signal for indoor geopositioning. I wonder if your project can take it to another level by mapping the signal strength to a map and use it for future indoor geo-positioning.

As always, thanks for the video. Could you please make a follow-up video explaining how to persuade my/any non-engineer wife/spouse to enable wifi on her smartphone all the time and not only when she needs it? You seem to be doing well at psychology :-)

Andreas, would it be possible to use Obstacle Detection sensor to detect a door opening from about 3 meters if used with a reflective sticker?

Such technology is built-in to many enterprise Wi-Fi solutions and has been used by major retailers for years.

What pubsubclient version did you use? (I used arduinojson 5.13.5 because i saw you say you used version 5.)

How about using BT for presence? There are a lot of BT tags, smart bands and so on that one can use.

Hi Andreas Spiess. It's been a great video. As always. From you, I'll be asking for the next video. Ultra low power SAMD21E. I want to use this. The battery can be operated for years. How can I use arduino ide in this alone. SAMD21 Microcontroller + RFM95 Lora Module. Can you make the video?

I am thinking about a mix of this project + the LoRa project as to track 4 street corners with 8 devices (40 meters each other)

Is it possible to get a list of all the mac addresses of the phones near the device ?. Another question, can this be done also with the nodemcu 8266, or esp32? Thank you very much.

The scanning time for each channel could be reduced to 120 ms to detect signals emmitted every 100 ms. This should be sufficient to detect at least one signal from every device present on a Channel. Speeds up scan by 40%.

Awesome!

Sorry I dont understand fully. Is the ESP connected to wifi when it does the sniffing? I have a project which I want to implement this, but I don't want to have to add a second ESP, as my main one needs to host a server.

The ArduinoJSON library is great indeed.

An improvement on this for detection of intruders that could be more reliable than just signal strength... If a detected device is not associated with any of the known access points in 3 "detection windows". Alert. Eliminates your neighbours devices. And gives devices a few moments to associate with an access point. This then also gets around the random mac issue by identifying it based on behaviours not macs. :)

I was recently considering logging GSM devices in the vicinity of equipment trailers left overnight.This is much easier.

"Sooner leave a child in a supermarket then forget our cellphones". LOL, good one!

Another idea: one can identify the authorized MACs automatically by monitoring as well: each MAC that transmitts regular data frames to the known AP address must have been authenticated before -> this is a family member's device.

Oh, BTW, would the code work also with the ESP32 like Lolin? Thanks

Hi Mr. Andreas, what a great and fantastic videos. Can you teach on how to filter out those randomize mac from Iphone or macbook detected in our neighbour because it is very annoying and could not really make it to detect real stranger because their iphone and macbook keep pushing randomize mac. Please help ya...

Is there a guide anywhere to make and do this, also can you next them to raspberry pi and search many channels? Thank you for great work

Many thanks for this great video! But there was one thing I had to change in the code to get it working correctly. Before my change, the ESP-01 was only able to connect to WiFi once. The second time it just wouldn't connect anymore. To solve this I added two lines of code at line 233 in WiFi_Sniffer.ino, between the delay(100) and wifi_promiscuous_enable(enable). So it now looks like this: delay(100); wifi_set_opmode(NULL_MODE); wifi_set_opmode(STATION_MODE); wifi_promiscuous_enable(enable);

Now I just need a Star Trek whoosh sound when I go through my doors.

Wenn man das ganze jetzt noch Anwenderfreundlich hinbekäme, wäre es ein Träumchen. Beispielsweise Einstellungen über ein Webinterface vornehmen, das man es simpel in sein System einbinden kann, oder Geräte simpel als "bekannt" zu markieren. Werde es trotzdem demnächst mal testen, aber für eine Benutzerfertige Lösung würde ich sogar Geld ausgeben!

After reading the title of this video, I thought this one was going to be narrated by your cat!

Hi, great video. Is it possible to have the esp32 detect only a pre set Wi-Fi MAC address like in the BLE version. I want to use my iPhone but can’t do it on the BLE version.

Is this really practical for detection? My guess is there will be many false alarms, especially regarding trying to calibrate proximity. And there are so many wifi enabled devices people have and add to their homes that it would be hard to keep track of them all. However, knowing if a known device/person is home may be helpful for automation tasks.

This could also be used to control your central heating, and not turn it on if you or any family member is not at home

Hi might I ask what mqtt server do you use because I did what you said (in my mind) but my esp is ending mqtt connection loop

Normally a wi-fi client doesn't send beacons, that is something only properly configured access-points do. A wi-fi client does send a signal if it is connected to a network and has to respond to something. Or it has to send probe-requests if it isn't connected to a network, but there are saved "hidden" networks. People can als start access-points on their smart-phone to allow other clients to use its internet-connection. But this inverts the roles, the client becomes an access-point and if properly configured it will send beacons. A hidden network is, when an access-point doesn't send beacons. Unfortunately this feature is still advertised as some sort of security feature and people propagate this idea because it sounds plausible if you don't understand what is going on. But the result is worse than sending beacons. The hidden access-point isn't hidden! It has to respond to requests from its clients and this makes the access-point visible again. Therefore there is nothing to win with "hidden" networks. But now all the clients have to always ask for the presence of that saved hidden network, they are now visible too. This feature is a idea with a good intention but failed implementation. It shouldn't be used but unfortunately many people still propagate that it is something "good" and it is still advertised as a security feature. -Anyways, I saw only the beginning of the video until it was clear that it is just a wi-fi scanner, monitoring mode with automatic channel-switching - i prefer to use the "horst" wi-fi scanner for this on a slightly bigger computer. I will watch the rest of the video later. ;)- _Edit: I fixed a typo and formatted the last paragraph in __-strike-through-__ because I have seen it now. In a 2nd edit I added the info about what I have edited._

Hallo Andi, ein Bekannter verwendet Bluetooth für den selben Zweck. Das wäre wohl mit dem ESP32 auch möglich oder täusche ich mich da? Vielen Dank für die präzisen Infos.

One of the problems with Apple cloaking MAC addresses is that the excellent Fing network device identifier loses some of its functionality. It still fully works OK with Android devices. Since my iPad is no longer as useful as it used to be, under the latest iOS, plus Apple no longer controls iPad apps with iTunes, I can safely say that I have bought my last Apple device (and I've owned two iPhones, three iPads, and two Macs).

if someone else have similar problem any ideas: when I power esp8266 on the node red resive first set od mac addreses. but next loop it get stuck in .......... mode as it tray to conenct to wifi. Any ideas whay. tray with diffrent routers.

Good, I would like to know if it is possible to locate the MAC addresses of the phones near the esp8266, but without the need for the devices to be connected to a router. That is, just by having the wifi activated.

hi Andreas thank you for another great video. meanwhile i would like to give you just a heads up. the pubsubclient library by default only supports 128 maximum packet size, wich is not enough if you have many devices in your wifi network. this will cause that some (many) mqtt messages will not be published. to avoid this, just set the flag MQTT_MAX_PACKET_SIZE to a higher size (i,e, 512) in pubsubclient.h file.

Can you do the same using bluetooth? if so you could use both lists to match users.

1:22 It's not entirely true that all WiFi capable smartphones constantly poll for a WiFi hotspot. My Samsung in fact turns off its WiFi when outside a geo-fence of regularly connected WiFi networks. I believe this is the default battery saving setting for at least Samsung S10 and S21 phones.

10:27 That could be the reason for offering free WiFi everywhere, covering the whole site of a mall, shop, etc. In addition to the data you're directly supplying by surfing in their wifi net, you also provide lots of positional data. It really is 1984 now, but with corporations controlling and observing your every move, instead of a police state. What a time to be alive.

well, just in time for me. I'm building a domotic system for my home. Great!