Passive Taxonomy of Wifi Clients using MLME Frame Contents

[Denton Gentry]

On Thu, Apr 26, 2018 at 12:00 PM <hostap-request at lists.infradead.org> wrote:
> Date: Wed, 25 Apr 2018 13:19:41 -0600
> From: Swapnil Samant <swapnilsamant at gmail.com>
> To: hostap at lists.infradead.org
> Subject: Passive Taxonomy of Wifi Clients using MLME Frame Contents
> Message-ID:
>          <
CAPJcZmTufCmS+x6niTeNWN3jcBjs1zv47hEGXpQdvH+rMVo8Yg at mail.gmail.com>
> Content-Type: text/plain; charset="UTF-8"

> Hello, I am trying to use the passive taxonomy feature of hostapd. I
> have compiled hostapd using the CONFIG_TAXONOMY flag and trying to get
> the clients signature using the hostapd_cli "signature" command. When
> I run the command hostapd_cli signature pp:qq:rr:ss:tt:uu, I can't get
> the clients signature. I am using hosted v 2.6 with dnsmasq 2.79. The
> clients are connecting to the hostapd (verified with hostapd_cli
> all_sta) but I can't get the signature. I would appreciate any help I
> can get from you guys. Thank you!


A couple possibilities:
1. I recall on OpenWRT the default compilation flags resulted in getting no
signature back via hostapd_cli. However I think it failed all CLI commands,
and you said all_sta works, so that is likely not it.

2. hostapd has to have seen both a probe request and an association request
from the client before it can form a signature. There are a few clients
which are very sparing in sending probes, notably ChromeOS. The client can
be joined via just seeing the beacon and sending an Associate Request, but
not have a signature until hostapd sees a probe.