Detecting and logging "unknown" phones on my Wifi network - Page 1
Forum section: electronics / projects

author: tru3533
author_rank: Regular Contributor
timestamp: August 12, 2023, 11:57:15 am
content: On my windows pc looking at Windows explorer - NetworkI can see phones popping up passing by my WiFi network, they are not connected, just advertising as my network isvisible.Do you know a way to log this activity?

author: Psi
author_rank: Super Contributor
timestamp: August 12, 2023, 01:22:18 pm
content: I'm not sure that makes sense, you shouldn't see any random phones that try to connect unless they have successfully connected with the correct key.Unless by 'visible' you mean your wifi network is open/unencrypted?I'm assuming by visible you just mean the SSID is visible.Perhaps if your router supports VOIP wifi phones or something, and maybe that uses a different open wifi network. Then maybe your router might show them up as devices on the network if they are in range.

author: tru3533
author_rank: Regular Contributor
timestamp: August 12, 2023, 02:12:25 pm
content: I think this tread explains ithttps://answers.microsoft.com/en-us/windows/forum/all/unknown-devices-shows-connected-on-network-map-in/a6da1e87-569b-423b-af70-f5c3dfbaf955Quote

author: tru3533
author_rank: Regular Contributor
timestamp: August 13, 2023, 09:44:40 am
content: So now we know how this work, question remain how to log incoming phones.Can be very handy as a visitor alert in your WiFi covered area

author: Shonky
author_rank: Frequent Contributor
timestamp: August 13, 2023, 10:18:04 am
content: I doubt these are WiFi devices. More likely Bluetooth. If a device is not correctly connected to your access point because it doesn't have the key (WPA etc) then that's where it ends. Your PC on WiFi or LAN sees nothing of these external devices."devices advertising as your network is visible" is not a thing.Your suggestion to log visitors in your WiFi (or any kind of Bluetooth) coverage will not work for many/most devices.

author: tru3533
author_rank: Regular Contributor
timestamp: August 13, 2023, 11:07:36 am
content: I live in a rural area and can confirm this is WiFi, the phones connected is my neighbor's phones and are not in range for Bluetooth.I found this page explaining what happens:QuoteRead more here:https://appuals.com/fix-unknown-strange-devices-showing-network/

author: Shonky
author_rank: Frequent Contributor
timestamp: August 13, 2023, 11:25:13 am
content: I'm not convinced. Some of that explanation doesn't really make sense either.It also mentions rogue devices which seems to prevent your visitor idea from being useful.As a brute force method a second WiFi NIC set to monitor mode (not all chipsets/drivers support this) could just capture these apparent requests and filter and log them. Seems overkill if Windows is finding these devices.

author: tru3533
author_rank: Regular Contributor
timestamp: August 13, 2023, 12:19:06 pm
content: Well, I don't work for Microsoft, just observing what I see on my pc.Looking at properties for the mobile showing up is exactly what the article explains.The information shown is more than enough to identify the phone, so I can filter out the neighbor.and alert for unknown phones entering the area.Manufacturer: SAMSUNG_ELECTRONICSModel:SAMSUNG_MOBILEModel number: 2013MAC address: I know this can change, but on this phone it's not changingIP address: Unavailable (because it's not connected to my network)Using Windows Connect Now (WCN) with the wcncsvc.dll seems to be the way to go, if I can figure out how to use it.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: August 13, 2023, 02:20:37 pm
content: Maybe your neighbours phone is sending out a beacon SSID for tethering or Wifi Direct - which is a Samsung thing. Windows is attempting to connect to their phone, not the other way around.

author: tru3533
author_rank: Regular Contributor
timestamp: August 13, 2023, 04:33:17 pm
content: Possible.. but all the phones visiting are doing the same

author: AndyBeez
author_rank: Frequent Contributor
timestamp: August 13, 2023, 04:54:17 pm
content: If not Wifi or BLE, then next I might suspect an unwanted behaviour from the UPnP protocol. Those random phones may have uPnP enabled on them or, noting your wifi network has uPnP enabled > so the 'zero-config' nature of uPnP means SSDP is just discovering them correctly - but the result is ambiguous to a humanuPnP can be a crap-shoot to get working how you might expect it to work. Maybe experiment with turning off uPnP on the router or the PC's network card. Whatever the root cause, from what I can see here, these are not devices that are being connected to your network.https://learn.microsoft.com/en-us/windows/win32/upnp/overview-of-universal-plug-and-play

author: mikerj
author_rank: Super Contributor
timestamp: August 13, 2023, 05:08:54 pm
content: If it was Bluetooth or UPNP then disabling WPA wouldn't change the behaviour, but it definitely does. I noticed these phones appearing in explorer some months back after I did a factory default reset on my router and forgot to disable WPA, disabling it fixed this.

author: IanB
author_rank: Super Contributor
timestamp: August 13, 2023, 05:10:00 pm
content: Quote from: tru3533 on August 12, 2023, 11:57:15 amI believe this is standard behavior by both Google (Android) and Apple phones.It is used for location services.The phone in your pocket, and every other phone, is always scanning the nearby wi-fi networks and associating them with the current GPS location. The geographical coordinates and MAC address of the network are then relayed back to Google and to Apple servers.Google and Apple each have a giant database containing every wi-fi network in the world and its location.Hence, when your computer wants to find its location, it simply listens for nearby wi-fi networks, checks the signal strength, and triangulates to get the location. If you open Google maps on your computer and ask it to pinpoint your location, this is how it does it without having GPS available.On the other hand, I don't know why the phones are actually showing up on the network. Merely scanning the network's broadcast information should not cause a device to appear connected.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: August 13, 2023, 05:12:39 pm
content: Quote from: mikerj on August 13, 2023, 05:08:54 pmThis is why I learnt to hate Windows.

author: amyk
author_rank: Super Contributor
timestamp: August 13, 2023, 10:20:58 pm
content: Just put a MAC address filter on the AP if you don't want them to connect.

author: tru3533
author_rank: Regular Contributor
timestamp: August 13, 2023, 10:36:41 pm
content: When you click on the Network in your ‘File Explorer’, Windows Connect Now, sends out a ‘packet/beacon’ to not only get a list of the current devices connected to your network, but also potential other devices that respond back to its request via Wi-Fi.It also reads the logs you usually cannot see yourself from a router to see what has within a certain amount of time sent out one of those packets, to try and give you the fullest list available of all possible devices you may connect to. This is the reason why you will not see these devices by accessing your router list from its settings and connections.As you can see from the properties from the phone it is not connected as it has no IP addressThe phone goes away after some time, and appear again on next scan.For me this function is most wanted, so question is how to do a "Windows Connect Now" and log the result?I want to make an alert for unknown phones entering my WiFi area.