IoT – The WiFi Probe REQ an RTLS. Tracking WiFi Devices for a penny.

zrzut-ekranu-2016-09-14-o-08-35-27

Every WiFi enabled device that you have (laptop, phone, tablet, kindle, watch, … ) is sending a PROBE REQuest packets in background to figure out if there are any known AP’s.
It’s done transparently, wether you are in a shopping center, outside in a park, or in the mountains – it’s a continuous process.
If an AP is found the device automatically associates to let you stay online ASAP. This is built in the 802.11 protocol. (More)

Knowing that every single device is broadcasting a Probe packet i figured out that it might be interesting to place couple of ESP8266 around with sniffer mode enabled to listen to these Probe Requests and forward them to a central server for analysis. The idea behind that is to be able to track every device between zones (places where ESP8266 are located) and guess what, i had couple of hours free to code and try it out.

I placed couple of nodes in different places within the city and enabled sniffer mode that looks for 0x40 802.11 type packets (PROBE REQUEST). When a packet is received it is sent out to a central server where packets are stored and presented later on on a web page.


This time i used ESP8266 on a ‘Witty’ chip – it’s a cool 2cmx2cm sized board that has a single button, rgb led built in and obviously an USB power. Pretty cheap, you can get tons of them for almost ‘no money’.

Every single ESP8266 device in this system that listens for packets is called ZONE, so if you place 4 of them in different locations – you have 4 zones. I have placed 2 of them for tests, one in the Garage and one outside in the area where i live. This is to figure out if i can determine wether people (and at what time) travel between garage and main area, how often and at what time. Time for a start, ESP’s placed, kick started – analysis time.

zrzut-ekranu-2016-09-14-o-08-51-13

The above graph shows number of packets for every hour in last 24hours, there’s a quite number of packets received as you can see, big-data time 😉

As i have two zones, let’s see how active they are – meaning, when was the last packet received at which zone – this helps me out to determine the Per-zone activity and eventual down-times of the zone nodes.

zrzut-ekranu-2016-09-14-o-08-52-49

You can clearly see that both zones received their last packets 2/3 seconds ago – so somebody was hanging around there with a device sending probe requests, good! Let’s move on, let’s find out what is the packet per zone distribution.

zrzut-ekranu-2016-09-14-o-08-54-28

Sensible, the MAIN zone that is outside in the main area of my home is definitely more active, garage makes only 6.7% of all the packets received. Let’s find out what happened in GARAGE in last 24 hours.

zrzut-ekranu-2016-09-14-o-08-55-52

Ahh more graphs, more stats – fantastic. GARAGE Zone received 62 Probe packets in last 24hrs, the peak was around 7 am (where people started to jump into their cars to drive to work).  In total there are 17 UNIQUE devices found, so potentially we can assume there were 17 persons in the zone. Need more info…

zrzut-ekranu-2016-09-14-o-08-57-28

Brilliant, i can see which device was the most ‘popular’ one, meaning was having the biggest ratio of PROBEs sent across the 24hrs time and in total. Beside i can see live packets coming in from the ESP. Let’s look at this B0:79 – looks like the most popular one, a single click on the device and we’re entering a Device tracker sub-page where..

zrzut-ekranu-2016-09-14-o-08-58-54

I can figure out that it is a Motorola device (based on MAC OUI) and

zrzut-ekranu-2016-09-14-o-08-59-04

This Motorola sent 32 packets in last 24hrs, it was seen only in one zone (GARAGE) and it was most active today at 07:00 AM. Great, let’s go deeper…

zrzut-ekranu-2016-09-14-o-09-01-03

Above is a confirmation of the fact that Motorola was seen only in Garage (wasn’t captured by MAIN zone) – live packets on the right hand side. But let’s see the whole history of this device shall we?

zrzut-ekranu-2016-09-14-o-09-02-31

You can clearly look at each of the devices found and track it’s activitiy. What’s even more i can see the RSSI value – that tells me the distance of the device to the zone node.
This Motorola was first found today at 02:52 AM, interesting. The RSSI tells me it was probably on the opposite side of the garage (which is quite big) – meaning far away from the node! Knowing the Garage i can immediately figure out where this person was moving.

Let’s go back and pick up different device.

zrzut-ekranu-2016-09-14-o-09-17-25

zrzut-ekranu-2016-09-14-o-09-17-48

This one is more interesting, somebody was seen in both zones with this device, i wonder at what distance and time.

zrzut-ekranu-2016-09-14-o-09-18-50

First seen at 7:54 today, wen to a garage (7:55) and was pretty close to the NODE at 7:56. Then the signal is getting weaker (jumped into the car probably) as minute later the signal was lost.

As you can see a simple system that costs $3.20 for each node can be turned into a quite sensible real time location service. Knowing that a deployment of 100 of nodes is still low cost – you can imagine how this can help out in business stats, emergency tracking, and advertisement targetting systems (tv screens knowing the profiles  (vendor) of candidates per week/month/season can push targeted ads). There is a big space for project like this to go live and for sale. It’s nothing new – but it’s definitely the most affordable one you can get ($3.20 for a node!).

zrzut-ekranu-2016-09-14-o-09-23-25

zrzut-ekranu-2016-09-14-o-09-23-44

In terms of the project – i keep it live, costs almost nothing so i’ll be adding nodes just for fun 😉

Update. I recalculate RSSI to Meters (distance), it makes more sense now.

zrzut-ekranu-2016-09-14-o-12-05-40

 

Advertisements

One thought on “IoT – The WiFi Probe REQ an RTLS. Tracking WiFi Devices for a penny.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s