Recording wireless MAC addresses

There are a lot of phones, tablets, laptops and other devices that transmit data on wireless networks. Most of them use an “active” scan technique (details) and they send packets around periodically.

Since all packets have a “source MAC address” field, I tried to record all MAC addresses that send packets around when my device is in range.

I used a Raspberry Pi 2 device with a WiFi antenna to capture network packets, my phone with a simple app to record the GPS route and my bike to move around the city :). Here are the results:

My path:

I managed to capture 10000 unique source MAC addresses in a few hours. Here is a plot (each red pixel is around where I first spotted a unique MAC address):

That line where there were very few red dots, I took the subway in each direction, so that explains it. On the left of the map, I met a friend and went for a beer. And by looking at the data afterwards, I managed to easily extract my friend’s MAC address: I searched for a source address that was in my range most of the time when we met. And there was only one result. Here are all the positions where I spotted packets from this exact MAC address:

I wanted to do more digging into this data, but I’m not sure what I can do with it.

What’s clear is that smartphones can easily be tracked and that there are a LOT of devices out there 🙂