URGENT HELP REQ. Need Script to scan for MAC Address on WLAN

BobcatGuy · Mon Apr 16, 2012 1:37 am

I had some computer equipment stolen, without getting into to many details as to why this is important to do and recover the device. Involves hit and run, IE a pedestrian was hit by a car by the fleeing thief.

The Equipment has WIFI on it, the approximate location is known of where this equipment ended up.

What I am looking to do is run a script that will scan channels on the 2.4 Ghz spectrum and check for one specific MAC address for traffic to or from it.
This combined with a directional antenna should locate the device. and alot of work.

If anyone can help with this type of script, I would be very appreciative!

I know the ROS already has a scan feature built in, but I am looking to be able to get notification when the MAC shows up on the WLAN.

c0d3rSh3ll · Tue Apr 17, 2012 9:09 pm

if pc connect to ap

{
local mac "00:02:6F:6D:77:D1"
local i [/interface wireless registration-table get value-name=mac-address number=[/interface wireles registration-table find]]
if ($mac=$i) do={log error "mac $mac detected"}
}

scampbell · Wed Apr 18, 2012 4:30 am

The alignment tool in the wireless interface can be programmed to look for a specific Mac address.

When found the RB will start beeping

BobcatGuy · Wed Apr 18, 2012 4:45 am

Will this work even though it is a station and not an AP?

scampbell · Wed Apr 18, 2012 8:53 am

Should do

scampbell · Wed Apr 18, 2012 8:54 am

It should - alignment needs to work both ways in a p2 p link

skot · Wed Apr 18, 2012 7:02 pm

A few questions:

1. Is the stolen wifi device an AP or wireless router? Or a client (laptop)?

2. Is it possible for you to associate with the stolen wifi device? Or not?

3. When you run the script to scan for this device, are you sitting in front of the computer watching the results? Or, do you want the script to run in the background and if/when it finds the MAC, it alerts you in some way?

smilem · Thu Jul 12, 2012 5:56 pm

I'm trying to do something simmilar but the script does not scan for me when executed as script, and when executed from console I get this error:

http://forum.mikrotik.com/viewtopic.php?f=9&t=63522

{... local mac "00:02:6F:6D:77:D1"
{... local i [/interface wireless registration-table get value-name=mac-address number=[/interface wireles registration-table find]]
{... if ($mac=$i) do={log error "mac $mac detected"}                                                                                
{... }                                              
interrupted
           no such item

BobcatGuy · Wed Mar 06, 2013 12:27 am

Just for a follow up,

this was a Blackberry Playbook I was trying to locate. The playbook had credientials to connect to an AP that was mine before it was stolen. So After a few hours of driving in an area that I had some reason to beleive that it was in that area, I did manage to locate and recover it. I wont say how much RF power I was using and how many directional antenna's but It was quite the setup. Some "rules" of max RF power may have been overlooked for a few hours in the process. But, imagine what the guy said when the police knocked on the door to ask the person for the playbook.

But what was wierd was the idiot took pictures of himself and put them on the playbook. The more interesting part which helped was that the playbook still had creditials to connect to a mail server that I ran. which I had an option of getting RIM to lock the device and disable it, but I elected to allow the playbook to check for mail for about 2 weeks and get all the info including IP from the origin.

police called, they got the warrant, they were the ones who got the playbook back, and you may ask, well, if they recovered it, why did I need to scan MAC addresses on WIFI to find it myself?

This I cannot comment on. haha

Now to find a use for the playbook.

skot · Wed Mar 06, 2013 4:43 am

I wont say how much RF power I was using and how many directional antenna's but It was quite the setup. Some "rules" of max RF power may have been overlooked for a few hours in the process.

Lol! I can imagine.