The Wireless Shark: Identifying WiFi Devices Based on Probe Fingerprints

Abstract

Due to the broadcast nature of WiFi communication anyone with suitable hardware is able to monitor surrounding traffic. However, a WiFi device is able to listen to only one channel at any given time. The simple solution for capturing traffic across multiple channels involves channel hopping, which as a side effect reduces dwell time per channel. Hence monitoring with channel hopping does not produce a comprehensive view of the traffic across all channels at a given time. In this paper we present an inexpensive multi-channel WiFi capturing system (dubbed the wireless shark") and evaluate its performance in terms of traffic cap- turing efficiency. Our results confirm and quantify the intuition that the performance is directly related to the number of WiFi adapters being used for listening. As a second contribution of the paper we use the wireless shark to observe the behavior of 14 different mobile devices, both in controlled and normal office environments. In our measurements, we focus on the probe traffic that the devices send when they attempt to discover available WiFi networks. Our results expose some distinct characteristics in various mobile devices' probing behavior.