Silicon ChipWiFi Snooping with a Raspberry Pi - February 2021 SILICON CHIP
  1. Outer Front Cover
  2. Contents
  3. Publisher's Letter: New computer technology
  4. Mailbag
  5. Feature: Radio Time Signals throughout the World by Dr David Maddison
  6. Feature: Follow-up: Quantum-dot Cellular Automata by Dr Sankit Ramkrishna Kassa
  7. Project: Battery Multi Logger by Tim Blythman
  8. Project: Arduino-based Adjustable Power Supply by Tim Blythman
  9. Serviceman's Log: A feline-themed cautionary tale by Dave Thompson
  10. Project: Electronic Wind Chimes by John Clarke
  11. Circuit Notebook: LCD clock and thermometer by Mahmood Alimohammadi
  12. Circuit Notebook: DIY laser rangefinder by Bera Somnath
  13. Circuit Notebook: Animal and pest repeller by Warwick Talbot
  14. Circuit Notebook: Stable multi-frequency sinewave generator by Petre Petrov
  15. Circuit Notebook: WiFi Snooping with a Raspberry Pi by Sid Lonsdale
  16. Feature: Making Android Apps with App Inventor by Roderick Wall
  17. Feature: Making a Compact Virtual Electronics Workbench by Tim Blythman
  18. Feature: Upgrading your Computer to the latest CPU by Nicholas Vinen
  19. PartShop
  20. Feature: El Cheapo Modules: LCR-T4 Digital Multi-Tester by Jim Rowe
  21. Vintage Radio: Philips 1952 BX205 B-01 AM/SW battery valve radio by Charles Kosina
  22. Ask Silicon Chip
  23. Market Centre
  24. Notes & Errata: Busy Loo Indicator, January 2021; Mini Digital AC Panel Meters, January 2021; Radiating test antenna for AM Radios, Circuit Notebook, January 2021; Vintage Battery Radio Li-ion Power Supply, December 2020; Colour Maximite 2, July-August 2020
  25. Advertising Index
  26. Outer Back Cover

This is only a preview of the February 2021 issue of Silicon Chip.

You can view 0 of the 112 pages in the full issue.

For full access, purchase the issue for $10.00 or subscribe for access to the latest issues.

Items relevant to "":
  • BWD602 Documents (Software, Free)
Items relevant to "Follow-up: Quantum-dot Cellular Automata":
  • QCA follow-up: Potential Energy Explanation (Software, Free)
Articles in this series:
  • Quantum-dot Cellular Automata (August 2019)
  • Follow-up: Quantum-dot Cellular Automata (February 2021)
Items relevant to "Battery Multi Logger":
  • Battery Multi Logger PCB [11106201] (AUD $5.00)
  • PIC16F1455-I/SL programmed for the Microbridge [2410417A.HEX] (Programmed Microcontroller, AUD $10.00)
  • PIC32MX170F256B-I/SO programmed for the Battery Multi Logger [1110620A.hex] (Programmed Microcontroller, AUD $15.00)
  • DS3231MZ real-time clock IC (SOIC-8) (Component, AUD $10.00)
  • DS3231 real-time clock IC (SOIC-16) (Component, AUD $7.50)
  • SMD resistor - 15mΩ ±1% M6332/2512 3W (CRA2512-FZ-R015ELF or similar) (Source component, AUD $2.00)
  • 2.8-inch TFT Touchscreen LCD module with SD card socket (Component, AUD $25.00)
  • Matte/Gloss Black UB3 Lid for 2.8-inch Micromite LCD BackPack (PCB, AUD $5.00)
  • Battery Multi Logger software [1110620A.hex] (Free)
  • Battery Multi Logger PCB pattern (PDF download) [11106201] (Free)
Articles in this series:
  • Battery Multi Logger (February 2021)
  • Battery Multi Logger - Part 2 (March 2021)
Items relevant to "Arduino-based Adjustable Power Supply":
  • Arduino-based Adjustable Power Supply PCB [18106201] (AUD $5.00)
  • SMD resistor - 15mΩ ±1% M6332/2512 3W (CRA2512-FZ-R015ELF or similar) (Source component, AUD $2.00)
  • MCP4251-502E/P dual 5kΩ digital potentiometer (Component, AUD $3.00)
  • Arduino-based Adjustable Power Supply Software (Free)
  • Arduino-based Adjustable Power Supply PCB pattern (PDF download) [18106201] (Free)
Articles in this series:
  • Making a Compact Virtual Electronics Workbench (February 2021)
  • Arduino-based Adjustable Power Supply (February 2021)
Items relevant to "Electronic Wind Chimes":
  • Electronic Wind Chimes PCB [23011201] (AUD $10.00)
  • PIC16F1459-I/P programmed for the Electronic Wind Chimes [2301120A.HEX] (Programmed Microcontroller, AUD $10.00)
  • Pair of CSD18534KCS logic-level Mosfets (Component, AUD $6.50)
  • Electronic Wind Chimes software [2301120A.hex] (Free)
  • Electronic Wind Chimes PCB pattern (PDF download) [23011201] (Free)
Articles in this series:
  • Electronic Wind Chimes (February 2021)
  • Electronic Wind Chimes - Part 2 (March 2021)
Items relevant to "LCD clock and thermometer":
  • Firmware for the LCD Clock and Thermometer (Software, Free)
Items relevant to "DIY laser rangefinder":
  • Firmware for the DIY Laser Rangefinder (Software, Free)
Items relevant to "WiFi Snooping with a Raspberry Pi":
  • Commands for WiFi Snooping with a Raspberry Pi (Software, Free)
Items relevant to "Making Android Apps with App Inventor":
  • TDR Android app (made using App Inventor) (Software, Free)
Items relevant to "Making a Compact Virtual Electronics Workbench":
  • Arduino-based Adjustable Power Supply PCB [18106201] (AUD $5.00)
Articles in this series:
  • Making a Compact Virtual Electronics Workbench (February 2021)
  • Arduino-based Adjustable Power Supply (February 2021)
Articles in this series:
  • El Cheapo Modules From Asia - Part 1 (October 2016)
  • El Cheapo Modules From Asia - Part 2 (December 2016)
  • El Cheapo Modules From Asia - Part 3 (January 2017)
  • El Cheapo Modules from Asia - Part 4 (February 2017)
  • El Cheapo Modules, Part 5: LCD module with I²C (March 2017)
  • El Cheapo Modules, Part 6: Direct Digital Synthesiser (April 2017)
  • El Cheapo Modules, Part 7: LED Matrix displays (June 2017)
  • El Cheapo Modules: Li-ion & LiPo Chargers (August 2017)
  • El Cheapo modules Part 9: AD9850 DDS module (September 2017)
  • El Cheapo Modules Part 10: GPS receivers (October 2017)
  • El Cheapo Modules 11: Pressure/Temperature Sensors (December 2017)
  • El Cheapo Modules 12: 2.4GHz Wireless Data Modules (January 2018)
  • El Cheapo Modules 13: sensing motion and moisture (February 2018)
  • El Cheapo Modules 14: Logarithmic RF Detector (March 2018)
  • El Cheapo Modules 16: 35-4400MHz frequency generator (May 2018)
  • El Cheapo Modules 17: 4GHz digital attenuator (June 2018)
  • El Cheapo: 500MHz frequency counter and preamp (July 2018)
  • El Cheapo modules Part 19 – Arduino NFC Shield (September 2018)
  • El cheapo modules, part 20: two tiny compass modules (November 2018)
  • El cheapo modules, part 21: stamp-sized audio player (December 2018)
  • El Cheapo Modules 22: Stepper Motor Drivers (February 2019)
  • El Cheapo Modules 23: Galvanic Skin Response (March 2019)
  • El Cheapo Modules: Class D amplifier modules (May 2019)
  • El Cheapo Modules: Long Range (LoRa) Transceivers (June 2019)
  • El Cheapo Modules: AD584 Precision Voltage References (July 2019)
  • Three I-O Expanders to give you more control! (November 2019)
  • El Cheapo modules: “Intelligent” 8x8 RGB LED Matrix (January 2020)
  • El Cheapo modules: 8-channel USB Logic Analyser (February 2020)
  • New w-i-d-e-b-a-n-d RTL-SDR modules (May 2020)
  • New w-i-d-e-b-a-n-d RTL-SDR modules, Part 2 (June 2020)
  • El Cheapo Modules: Mini Digital Volt/Amp Panel Meters (December 2020)
  • El Cheapo Modules: Mini Digital AC Panel Meters (January 2021)
  • El Cheapo Modules: LCR-T4 Digital Multi-Tester (February 2021)
  • El Cheapo Modules: USB-PD chargers (July 2021)
  • El Cheapo Modules: USB-PD Triggers (August 2021)
  • El Cheapo Modules: 3.8GHz Digital Attenuator (October 2021)
  • El Cheapo Modules: 6GHz Digital Attenuator (November 2021)
  • El Cheapo Modules: 35MHz-4.4GHz Signal Generator (December 2021)
  • El Cheapo Modules: LTDZ Spectrum Analyser (January 2022)
  • Low-noise HF-UHF Amplifiers (February 2022)
  • A Gesture Recognition Module (March 2022)
  • Air Quality Sensors (May 2022)

Purchase a printed copy of this issue for $10.00.

signal from the wiper goes through a multi-stage RC low-pass filter. The setting of the potentiometer will vary the source impedance seen by the filter and thus slightly alter the corner frequency. Still, since the square wave harmonics start at three times the fundamental frequency, this won’t materially affect its ability to filter them out. The fourth-order filters roll off at 24dB per decade, so the third harmonic will be attenuated by well over 30dB. The filters each have four passive stages, each with the same corner frequency but ten times the impedance of the last, so as to not overly load the previous stage. The output of each set of filters is AC-coupled to an op amp two-times gain stage, DC biased to the 2.5V half-supply rail generated using a pair of 10kW resistors and filtered by 100µF and 100nF capacitors. These stages not only apply gain to make up for signal lost in the filters, but also convert the high-impedance output of the filters into a low imped- WiFi Snooping with a Raspberry Pi Smartphones send out WiFi “probe requests” to see what access points are close by. These requests contain the MAC address of the WiFi module in the smartphone, which is a unique identifier for that phone. The first three bytes of the MAC address contain the OUI (Organisational Unique Identifier), sometimes called the Vendor ID. The IEEE assigns OUIs to vendors. The last three bytes are the unique device serial number assigned by the vendor. A monitoring device can silently capture probe requests, collecting information such as the date and time, MAC address and the signal strength, which indicates how close the phone is. Several devices can be strategically placed to triangulate the signal levels and pinpoint the location of the phone. Shopping centres, train stations, airports etc are already using systems like this. You can use a Raspberry Pi as a silent monitoring device by running a Python program called “probemon”. Probemon captures all the data mentioned above. Also, the probe request sometimes contains the Access Point details that the phone was last connected to. When that happens, it is also captured by probemon. To use this software, you will need a USB WiFi adaptor that supports “monitor” mode (the internal WiFi on the Pi does not). I bought a RaLink RT5370 via eBay for less than $10. First, install Raspbian Buster on the Pi. Then plug in the USB WiFi adaptor and check it with the following command: lsusb Note the WLAN number of the USB WiFi (probably wlan1). Unplug and replug the USB adaptor, and check again siliconchip.com.au to be sure. Then install aircrack-ng: sudo apt-get install aircrack-ng Run airmon-ng (a part of aircrackng) to kill processes that will conflict with Monitor Mode: sudo airmon-ng check kill Put the WiFi adaptor into monitoring mode: sudo airmon-ng start wlan1 Check that you now have a virtual adaptor (wlan1mon): ifconfig Install netaddr, scapy and probemon: mkdir python cd python git clone https://github.com/ drkjam/netaddr cd netaddr sudo python setup.py install cd ~/python git clone https://github.com/ secdev/scapy.git cd scapy sudo python setup.py install cd ~/python git clone https://github.com/ nikharris0/probemon.git cd probemon Now test probemon: sudo python probemon.py –i wlan1mon –f –s –r –l It will take a few minutes before you see any results. You will likely get some errors that need fixing by editing the file “/home/pi/python/probemon/ probemon.py”. If you encounter the error type object ‘datetime.datetime’ has no attribute ‘datetime’, change line 36 of that file from: Australia’s electronics magazine ance signal, suitable for driving other equipment. These signals are again AC-coupled to remove the 2.5V DC bias and then fed to the output terminal pairs via 10W isolating resistors. The remaining six square wave signals are simply fed to a separate set of outputs via 47W isolating resistors. The whole thing is powered from a 5V USB supply, with LED1 lighting to indicate the presence of power. Petre Petrov, Sofia, Bulgaria. ($80) log_time = datetime.datetime. now().isoformat() to: log_time = datetime.now(). isoformat() The RSSI value doesn’t work, so change line 56 from: rssi_val = -(256-ord( packet.notdecoded[-4:-3])) to: rssi_val = packet.dBm_AntSignal Now the list of approved MAC Address Vendors has to be updated: curl http://standards-oui.ieee. org/oui.txt --output /home/ pi/python/netaddr/netaddr/ eui/oui.txt cd ~/python/netaddr/netaddr/eui python ieee.py cd /home/pi/python/netaddr sudo python setup.py install Rerun the capture program, and it should be fully working: cd ~/python/probemon $ sudo python probemon.py –i wlan1mon –f –s –r –l Captured data is stored in probemon.log. iPhones use MAC address randomisation, so the only time the correct MAC address is sent in a packet is when it is connected to a WiFi Access Point. Other times, it is recorded in the log file as “UNKNOWN”. When previously connected SSIDs are captured, you can search www. wigle.net which has a vast number of Access Points in its worldwide database. You can also enter your home address into www.wigle.net and see what Access Points are near you. Sid Lonsdale Cairns, Qld. ($80) February 2021  73