Detecting and logging "unknown" phones on my Wifi network

[tru3533]

On my windows pc looking at Windows explorer - Network
I can see phones popping up passing by my WiFi network, they are not connected, just advertising as my network is
visible.

Do you know a way to log this activity?

[Psi]

I'm not sure that makes sense, you shouldn't see any random phones that try to connect unless they have successfully connected with the correct key.

Unless by 'visible' you mean your wifi network is open/unencrypted?
I'm assuming by visible you just mean the SSID is visible.


Perhaps if your router supports VOIP wifi phones or something, and maybe that uses a different open wifi network. Then maybe your router might show them up as devices on the network if they are in range.

[tru3533]

I think this tread explains it
https://answers.microsoft.com/en-us/windows/forum/all/unknown-devices-shows-connected-on-network-map-in/a6da1e87-569b-423b-af70-f5c3dfbaf955

" I found that my new router for IPv6 had WPS enabled. I never use that so I disabled it and now no phones show up.

I assume that the want-to-connect device shows up in the Windows network because many routers have a physical button on the side to press to simplify connection without typing in a password, and this is a sensible way to show that the device is ready to connect. Now that I have explained it all to myself it seems sensible, and I am happy.

The steady march of a huge range of phone that I was seeing must be from passing cars, with maybe a neighbour sometimes."

[tru3533]

So now we know how this work, question remain how to log incoming phones.

Can be very handy as a visitor alert in your WiFi covered area

[Shonky]

I doubt these are WiFi devices. More likely Bluetooth. If a device is not correctly connected to your access point because it doesn't have the key (WPA etc) then that's where it ends. Your PC on WiFi or LAN sees nothing of these external devices.

"devices advertising as your network is visible" is not a thing.

Your suggestion to log visitors in your WiFi (or any kind of Bluetooth) coverage will not work for many/most devices.

[tru3533]

I live in a rural area and can confirm this is WiFi, the phones connected is my neighbor's phones and are not in range for Bluetooth.

I found this page explaining what happens:

Reasons why you see strange devices on your network
If you see strange devices on your network manager, it is likely that your Wi-Fi is protected using a WPA (Wi-Fi Protected Access) protocol. Because WPA2 does not protect the physical and MAC layers (after all, everyone, even the wireless network owner, needs a minimum level of wireless access in order to get onto the network), the rogue cell phones attempted some sort of ‘meaningful’ access attempt to connect to your Wi-Fi therefore you will see in the Windows network manager.

To get available Wi-Fi list, the phone/device sends out a ‘packet’ of data requesting devices info, that other Wi-Fi devices and routers recognize, and respond to with information that is appropriate, in the case of a router for instance, its SSID (the Wi-Fi network name) and type of security challenge that will be needed if that device wishes to join. The initial sending out the information will almost always include its MAC address, which is usually assigned to a manufacturer. This attempt is all it takes for the cell phone or wireless device to show its owner that there is SSID ‘xyz’ available but it is secured. It appears that the rogue devices only do a partial handshake to the network as you receive Manufacturer, Model, Model Number, MAC address. IP Address is not performed as the handshake is not completed, so it fails to acquire network status. If the device has an IP address then it is connected to your Wi-Fi successfully.

Windows Connect Now on Windows 10 and 8 goes and does some further work. When you click on the Network in your ‘File Explorer’, Windows Connect Now, sends out a ‘packet/beacon’ to not only get a list of the current devices connected to your network, but also potential other devices that respond back to its request via Wi-Fi. For this reason, you will see the rogue devices even if your Wi-Fi is hidden. It also reads the logs you usually cannot see yourself from a router to see what has within a certain amount of time sent out one of those packets, to try and give you the fullest list available of all possible devices you may connect to, if you and that device both have the proper authority to do so. This is the reason why you will not see these devices by accessing your router list from its settings and connections.

Read more here: https://appuals.com/fix-unknown-strange-devices-showing-network/

[Shonky]

I'm not convinced. Some of that explanation doesn't really make sense either.

It also mentions rogue devices which seems to prevent your visitor idea from being useful.

As a brute force method a second WiFi NIC set to monitor mode (not all chipsets/drivers support this) could just capture these apparent requests and filter and log them. Seems overkill if Windows is finding these devices.

[tru3533]

Well, I don't work for Microsoft, just observing what I see on my pc.
Looking at properties for the mobile showing up is exactly what the article explains.

The information shown is more than enough to identify the phone, so I can filter out the neighbor.
and alert for unknown phones entering the area.

Manufacturer: SAMSUNG_ELECTRONICS
Model:SAMSUNG_MOBILE
Model number: 2013
MAC address: I know this can change, but on this phone it's not changing
IP address: Unavailable (because it's not connected to my network)

Using Windows Connect Now (WCN) with the wcncsvc.dll seems to be the way to go, if I can figure out how to use it.

[AndyBeez]

Maybe your neighbours phone is sending out a beacon SSID for tethering or Wifi Direct - which is a Samsung thing. Windows is attempting to connect to their phone, not the other way around.

[tru3533]

Possible.. but all the phones visiting are doing the same

[AndyBeez]

If not Wifi or BLE, then next I might suspect an unwanted behaviour from the UPnP protocol. Those random phones may have uPnP enabled on them or, noting your wifi network has uPnP enabled > so the 'zero-config' nature of uPnP means SSDP is just discovering them correctly - but the result is ambiguous to a human

uPnP can be a crap-shoot to get working how you might expect it to work. Maybe experiment with turning off uPnP on the router or the PC's network card. Whatever the root cause, from what I can see here, these are not devices that are being connected to your network.

https://learn.microsoft.com/en-us/windows/win32/upnp/overview-of-universal-plug-and-play

[mikerj]

If it was Bluetooth or UPNP then disabling WPA wouldn't change the behaviour, but it definitely does.  I noticed these phones appearing in explorer some months back after I did a factory default reset on my router and forgot to disable WPA, disabling it fixed this.

[IanB]

On my windows pc looking at Windows explorer - Network
I can see phones popping up passing by my WiFi network, they are not connected, just advertising as my network is
visible.

Do you know a way to log this activity?

I believe this is standard behavior by both Google (Android) and Apple phones.

It is used for location services.

The phone in your pocket, and every other phone, is always scanning the nearby wi-fi networks and associating them with the current GPS location. The geographical coordinates and MAC address of the network are then relayed back to Google and to Apple servers.

Google and Apple each have a giant database containing every wi-fi network in the world and its location.

Hence, when your computer wants to find its location, it simply listens for nearby wi-fi networks, checks the signal strength, and triangulates to get the location. If you open Google maps on your computer and ask it to pinpoint your location, this is how it does it without having GPS available.

On the other hand, I don't know why the phones are actually showing up on the network. Merely scanning the network's broadcast information should not cause a device to appear connected.

[AndyBeez]

If it was Bluetooth or UPNP then disabling WPA wouldn't change the behaviour, but it definitely does.  I noticed these phones appearing in explorer some months back after I did a factory default reset on my router and forgot to disable WPA, disabling it fixed this.

This is why I learnt to hate Windows.

[amyk]

Just put a MAC address filter on the AP if you don't want them to connect.

[tru3533]

When you click on the Network in your ‘File Explorer’, Windows Connect Now, sends out a ‘packet/beacon’ to not only get a list of the current devices connected to your network, but also potential other devices that respond back to its request via Wi-Fi.

It also reads the logs you usually cannot see yourself from a router to see what has within a certain amount of time sent out one of those packets, to try and give you the fullest list available of all possible devices you may connect to. This is the reason why you will not see these devices by accessing your router list from its settings and connections.

As you can see from the properties from the phone it is not connected as it has no IP address
The phone goes away after some time, and appear again on next scan.

For me this function is most wanted, so question is how to do a "Windows Connect Now" and log the result?
I want to make an alert for unknown phones entering my WiFi area.