43

I have an Angstrom Linux device acting as an access point, running hostapd, dhcpd, which works fine. Can I get a list of devices connected to the Wi-Fi? I know I can get the DHCP leases, but I need to know which devices connect through wlan0. I've tried this (iwlist has options):

iwlist wlan0 ap
iwlist wlan0 accesspoints
iwlist wlan0 peers

but all return:

wlan0     Interface doesn't have a list of Peers/Access-Points

iwconfig, iwgetid, iwpriv and iwspy are also present in /sbin, but don't seem to have options to display the client list.

Barun
  • 2,336
  • 20
  • 23
Jeff
  • 701
  • 1
  • 6
  • 13

8 Answers8

45

You should use iw dev wlan0 station dump as root

Mike Pennington
  • 2,452
  • 4
  • 31
  • 40
  • Thanks - I don't see this for my Arm 9 Angstrom yet, but I'll go look for it – Jeff Jun 10 '12 at 15:04
  • Perhaps you can [compile from source](http://linuxwireless.org/en/users/Documentation/iw#Getting_iw), assuming you have enough space or a CF for temporary storage – Mike Pennington Jun 10 '12 at 22:01
  • 2
    iw also depends on nl80211 support in the WiFi interface's driver - which is not present for all drivers yet... https://wireless.wiki.kernel.org/en/developers/documentation/nl80211 – Pierz Nov 30 '16 at 17:51
  • In case you have more than one devices, for example when having 2.4 GHz and 5GHz enabled, you might get an empty results back. This is an indicator that no client has connected to the specify interface or frequency. – Akendo Jul 05 '18 at 08:31
  • Also *i think* that if you have `wlan0.staX` (certain wds/multiap/4addr configs) you would need to specify that interface for all staX interfaces – nhed Jun 05 '21 at 01:17
  • The output of `iw -h` says at the end: `Do NOT screenscrape this tool, we don't consider its output stable.` – Craig McQueen Jan 17 '22 at 10:52
  • The above command as is will dump a lot of data. Just use i.e. `iw dev wlan1 station dump |grep "on wlan1"` – Gen.Stack Dec 15 '22 at 10:22
12

You could Use "arp" as root:

$ sudo arp

or:

$ sudo arp | sort 

kinda nicer, but you got the point :)

Tom Hunt
  • 9,808
  • 4
  • 25
  • 43
g3ck0
  • 177
  • 1
  • 2
  • 1
    Not sure why should this be downvoted, it does show what kind of clients (IP and MAC) are connected – psukys Dec 10 '14 at 11:18
  • 4
    It is downvoted because arp returns only hosts that are active on the network in the arp table on the host. If someone nasty associates with the AP and is passively sniffing they will never show up in the arp table. – Geoffrey Jul 18 '15 at 11:57
  • 3
    You don't need superuser privileges to dump the arp table. See also `ip n` on Linux. – Stéphane Chazelas Apr 17 '18 at 10:17
  • 1
    Didn't work for me. I call arp but it only contains entries for ethernet. If i use arp -i wlan0 nothing is shown. With iw dev wlan0 station dump it is working. – JackGrinningCat Dec 06 '18 at 13:24
  • 2
    arp is really just a mapping from L3 (IP) to L2 (MAC) addresses. Deriving any information about connected stations is wrong. Its a wrong place to look. An could be a strict layer2 device and pass traffic without ever knowing the IP address of the AP. So down-voting. – nhed Jan 07 '21 at 20:14
7

You can also find list of connected devices to your AP by using this command:

cat /var/lib/misc/dnsmasq.leases

dnsmasq.leases file lists all the devices which connected to AP so far. Also you can get list of all devices which connected to your device over WiFi or Ethernet by using this command:

sudo arp
Keivan
  • 197
  • 1
  • 5
  • 1
    That would be on systems that use dnsmasq as a DHCP server. The OP uses "dhcpd", presumably the ISC implementation. Also stations could associate and not request and DHCP lease or not send any IP or ARP traffic. – Stéphane Chazelas Apr 17 '18 at 10:20
  • 1
    AP does not need to be a DHCP server nor does it even need to understand/talk in IP, so both your suggestions are off – nhed Jan 07 '21 at 20:17
3

arp-scan

As said on this answer you can use arp-scan package. Just arp-scan -l.

arp-scan is a command-line tool for system discovery and fingerprinting. It constructs and sends ARP requests to the specified IP addresses, and displays any responses that are received.

With systemd/udev names I found very useful an alias to

sudo arp-scan -l -t 200 -I $(ls /sys/class/net | grep -o "wl[^\t]\+")

for the wireless interface and en instead of wl for wired interfaces.

  • -I --interface Use network interface . If this option is not specified, arp-scan will search the system interface list for the lowest numbered, configured up interface (excluding loopback).
  • -l --localnet Generate addresses from network interface configuration. Use the network interface IP address and network mask to generate the list of target host addresses.
  • -t --timeout Set initial per host timeout to ms, default=100. This timeout is for the first packet sent to each host.

To read the arp cache table cool kids nowadays use ip neighbor.

Pablo A
  • 2,307
  • 1
  • 22
  • 34
1

I use something like this fast solution:

awk '$4~/[1-9a-f]+/&&$6~/^wl/{print "ip: "$1" mac: "$4}' /proc/net/arp

The /[1-9a-f]/ filter removes MAC addresses like 00:00:00... from listing.

The /^wl/ filter removes all non-wireless interfaces (without "wl" at the beginning of their names).

The example result is:

ip: 192.168.0.1 mac: 64:6e:ea:d1:d3:0a
ip: 192.168.0.2 mac: a0:d3:a1:6d:d0:4a

Also, for my convenience, I use a file macs with list of mac addresses of this context:

90:94:97:9f:85:10 My Huawei
64:6e:ea:d1:d3:0a Rostelecom Router

To get a list of connected devices with parsing this file I use such command (the END section is unnecessary - it's an updater):

awk 'BEGIN{while((getline<"macs")>0){nmm=$0;gsub($1" ","",nmm);nmz[$1]=nmm}}$4~/[1-9a-f]+/&&$6~/^wl/{print $1 " " (nmz[$4]?nmz[$4]:$4);if(!nmz[$4]){nmz[$4]=$4;update=1}}END{if(update){system("gawk -f macupd.awk")}}' /proc/net/arp

So in this way the result will be:

192.168.0.1 Rostelecom Router
192.168.0.74 My Huawei

The macupd.awk is the script for updating macs file. It gets vendor names from file oui.txt (located in the same directory) and uses them as descriptions of unknown hosts/clients connected to your machine and writes them to the macs list file (you may disable this by removing END section from command). Here is the script:

#!/usr/bin/gawk -f
BEGIN{
    while((getline<"macs")>0){
        str++
        if($0!~"(^#|^$)"){
            nam=$0
            gsub($1" ","",nam)
            macnamz[$1]=nam
        }
    }

    while((getline<"/proc/net/arp")>0){
        if($4~/[1-9a-f]+/&&$6~/^wl/){
            if(!macnamz[$4]){
                mac=macv=$4
                gsub(":","",macv)
                vendor=substr(macv,1,6)
                rs=RS
                RS="\n|\r"
                while((getline<"oui.txt")>0){
                    if(toupper($1)~toupper(vendor)){gsub(/.*\t+/,"");macnamz[mac]=$0;update=1}
                }
                RS=rs
            }
        }
    }
    if(update){
        for(i in macnamz){print i " " macnamz[i] > "macs"}
        print "" > "macs"
    }
}

So if in the first running of my imperfect command the result will be (if all hosts where unknown):

192.168.10.1 00:d0:ef:aa:ee:ff
192.168.10.2 f4:bd:9e:00:00:00
192.168.10.3 00:22:72:11:22:33

The second running will be such:

192.168.10.1 IGT
192.168.10.2 Cisco Systems, Inc
192.168.10.3 American Micro-Fuel Device Corp.

The description of my script.

getline<"macs" - Reading lines from list

if($0!~"(^#|^$)") - Ignoring commented and empty lines.

gsub($1" ","",nam) - I used nam variable for description (everything after space).

macnamz[$1]=nam - Final conversion of line to a part of associative array (there can not be 2 duplicated MACs - 2nd will overwrite 1st).

getline<"/proc/net/arp" - Getting connected IPs and MACs.

if($4~/[1-9a-f]+/&&$6~/^wl/) - Filtering out header line, zero MACs, and non-wireless interfaces.

if(!macnamz[$4]) - If connected device is not registered in our macs file.

gsub(":","",macv) and vendor=substr(macv,1,6) - Getting first 6 symbols of MAC.

RS="\n|\r" - Because oui.txt may have MS Windows line endings.

gsub(/.*\t+/,"") - Removing tabs

macnamz[mac]=$0 - Converting line to an array member.

update=1 - This variable says that updating of file is necessary (if it is).

Evgeny
  • 86
  • 4
  • 1
    Doesn't this also list devices connected by wired interfaces? I just tried on a non-WiFi machine, and got results corresponding to its Ethernet interfaces. Perhaps we need`$6 ~ /wlan/` as the condition instead. Note, your version also misses some addresses - the char group should be `[0-9a-f]`. – Toby Speight Dec 15 '21 at 08:26
  • Does. If you want to show only wi-fi connections use '$4~/[1-9]+/&&$6~/^wl/' (my wlan device name is wlo1). My solution shows all connected network devices (your router and your clients) with ip and mac.The "[1-9]" I use to filter such: 00:00:00:00... mac addresses. So I'm not wrong :-) (a little bit wrong! "[1-9a-f]" will be correct). Maybe the 0x2 flag is router and 0x0 is client, I don't know. In my case it is. – Evgeny Dec 15 '21 at 09:05
0

the accepted answer is of course correct but some systems might be too old (or some drivers) for iw

if you have hostapd you probably also have hostapd_cli, so you can try

hostapd_cli list_sta

I down-voted any answer that was not iw because they rely on traffic actually traversing the link. Getting a list of think connected to your wifi should not depend on those things making higher level (OSI model-wise).

nhed
  • 399
  • 2
  • 12
  • Not everyone's got hostapd in use. iw, however, is present on most systems deploying wifi interfaces and `iw dev station dump` ought to work anyway. To just see the list of connected stations, i.e. use `iw dev wlan1 station dump |grep "on wlan1"` – Gen.Stack Dec 15 '22 at 10:21
  • @Gen.Stack just so were clear I did not throw shade at the `iw` answers. Where available that's fine but it is a relatively a newer interface and, from experience, `iw` is just not available everywhere. As you noted yeah `hostapd` is not always used. I have not had the pleasure of using `iwd` but i thought it was rare to have no mgmt daemon at all. – nhed Dec 16 '22 at 20:49
-1

There is also a free (commercial licence, unlimited duration trial with maximum of 5 devices displayed) GUI application, WifiGuard.

Pablo A
  • 2,307
  • 1
  • 22
  • 34
-2

On Ubuntu, After starting the hotspots by clicking in WiFi top right of screen in gnome, select WiFi and "Wi-Fi Settings", config opens, select hamburger top right in menu, "Turn On Wi-Fi Hotspot..."

In terminal display connected clients by running in superuser mode :

iw dev wlan0 station dump
Pieter
  • 196
  • 8