How to sniff for wireless MAC addresses in area - My laptop got stolen

A few days ago my apartment got broken in, and they took all the electronics, including my $1500 laptop.

We are pretty sure it's an inside job (as in someone from the same building), so I believe that the stuff is in someones apartment.

Is there any tool that tells you what wireless adapters are active within range? I have my laptops MAC address, so I could use that to find out who stole it. I think it's worth a shot.

Any help is appreciated thanks!


Fire up Backtrack if you haven't already. Since you're not after traffic - just the level 2 address - this should be easy.

First, start airodump-ng and with the command

airodump-ng  --berlin 60 <wireless interface here>

You'll get a screen that looks like:

airodump

In the area marked client there is a column describing power in decibels (i.e. the more positive the number the better.

Second, walk around until you see your target MAC pop up on the screen in the client area.

Third, continue walking around using the strength readout to home in on the laptop.

Note: this is by no means incredibly accurate or guaranteed to work at all.


MAC address is changeable, quite easily actually.

But, I guess you could always try with netstumbler, ethereal, or something alike.


I know that KisMac (a Mac OS X app, that can passively sniff Wireless networks) will show all wireless MACs that have associated with any base station that it can see traffic from [though it also sometimes shows the MAC of the host you're sniffing with], so I suspect that most of the other common wireless LAN tools can do it too.

(Be sure that you're looking for your laptop's wireless MAC!)


The tools mentioned in ldigas' answer are the way to go (netstumbler, ethereal)

The trick is finding out exactly where near you he (or she) may be. That takes strong signal strength analysis and triangulation.

What you should do is tell the police if you find the address. They can then do the legal legwork to find out where they are connecting to and back track them. Let them do their job (hopefully). At a minimum make sure the MAC address is in the police report.