Monitor WiFi association attempts

Question

I'm using hostapd to create an access point and I was wondering if there's any way for me to get an output of current or recent association attempts.

Ideally I'd like to see the MAC ID and any other lower level information. I'm more interested in monitoring at the physical level, not DHCP.

score 2 · Answer 1 · answered Apr 24 '15 at 02:58

In your hostapd.conf:

# Module bitfield (ORed bitfield of modules that will be logged; -1 = all
# modules):
# bit 0 (1) = IEEE 802.11
# bit 1 (2) = IEEE 802.1X
# bit 2 (4) = RADIUS
# bit 3 (8) = WPA
# bit 4 (16) = driver interface
# bit 5 (32) = IAPP
# bit 6 (64) = MLME
#
# Levels (minimum value for logged events):
#  0 = verbose debugging
#  1 = debugging
#  2 = informational messages
#  3 = notification
#  4 = warning
#
logger_syslog=-1
logger_syslog_level=2

You should see log like that after in messages :

hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: authentication OK (open system) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-AUTHENTICATE.indication(00:0c:f1:11:57:4e, OPEN_SYSTEM)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-DELETEKEYS.request(00:0c:f1:11:57:4e) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: authenticated 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: association OK (aid 1) 
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.11: associated (aid 1)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-ASSOCIATE.indication(00:0c:f1:11:57:4e)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e MLME: MLME-DELETEKEYS.request(00:0c:f1:11:57:4e)
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: event 1 notification
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: start authentication
 hostapd: wlan0: STA 00:0c:f1:11:57:4e IEEE 802.1X: unauthorizing port
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: sending 1/4 msg of 4-Way Handshake
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: EAPOL-Key timeout
 hostapd: wlan0: STA 00:0c:f1:11:57:4e WPA: sending 1/4 msg of 4-Way Handshake

@Omega It would be wrote in /var/log/messages usually but only if you configured it to log (see the hostapd.conf to be sure) — yagmoth555, Apr 24 '15 at 13:44
Hmm, this doesn't seem to be working. I've even restarted the service after making the config change. — Alexander Trauzzi, Apr 24 '15 at 14:03
@Omega Test by forcing the content with logger_syslog_level=0, anything should be logged. Remove it if too much detail to prevent your filesystem to grow too fast — yagmoth555, Apr 24 '15 at 14:56

score 0 · Answer 2 · answered Oct 06 '15 at 00:58

You can enable the control interface, and then use the built-in hostapd_cli to connect to its UNIX socket and issue commands.

In hostapd.conf :

ctrl_interface=/var/run/hostapd # default path of the socket, can be changed if needed
ctrl_interface_group=wifi # group that will own the socket, can be a name or GID

Monitor WiFi association attempts

2 Answers2