Linux – Monitor WiFi association attempts

hostapdlinuxmonitoringwifi

I'm using hostapd to create an access point and I was wondering if there's any way for me to get an output of current or recent association attempts.

Ideally I'd like to see the MAC ID and any other lower level information. I'm more interested in monitoring at the physical level, not DHCP.

Best Answer

In your hostapd.conf: 

# Module bitfield (ORed bitfield of modules that will be logged; -1 = all
# modules):
# bit 0 (1) = IEEE 802.11
# bit 1 (2) = IEEE 802.1X
# bit 2 (4) = RADIUS
# bit 3 (8) = WPA
# bit 4 (16) = driver interface
# bit 5 (32) = IAPP
# bit 6 (64) = MLME
#
# Levels (minimum value for logged events):
#  0 = verbose debugging
#  1 = debugging
#  2 = informational messages
#  3 = notification
#  4 = warning
#
logger_syslog=-1
logger_syslog_level=2

You should see log like that after in messages :

hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: authentication OK (open system) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-AUTHENTICATE.indication(00:0c:f1:11:57:4e, OPEN_SYSTEM)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-DELETEKEYS.request(00:0c:f1:11:57:4e) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: authenticated 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: association OK (aid 1) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: associated (aid 1)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-ASSOCIATE.indication(00:0c:f1:11:57:4e)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-DELETEKEYS.request(00:0c:f1:11:57:4e)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: event 1 notification
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: start authentication
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.1X: unauthorizing port
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: sending 1/4 msg of 4-Way Handshake
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: EAPOL-Key timeout
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: sending 1/4 msg of 4-Way Handshake
Related Topic