Repository navigation
Randomized MAC tracer
Experimental. The tracer may link the wrong devices or miss a link. Treat its results as leads, not proof.
Phones and laptops change their Wi-Fi and Bluetooth MAC address on a schedule to avoid being tracked. The randomized MAC tracer links those changing addresses back to one device and gives it a stable ID, such as T-00A3. You can then use that ID in a target scan or triangulation the same way you would use a real MAC. It tracks up to 256 devices at once.
A device that randomizes its MAC still gives itself away in the parts of its traffic that do not change with the address. The tracer builds a signature for each device from several of those parts and scores how well a new session matches a device it already knows. When the score passes a threshold, it links the new address to that device.
The signals it scores, and the published research each one comes from:
| Signal | What it compares | Research |
|---|---|---|
| Information-element fingerprint | The capability fields in a probe request: HT and VHT capabilities, supported rates, extended capabilities, and vendor elements | Vanhoef et al., ASIA CCS 2016 |
| Information-element order | The order those fields appear in | Vanhoef et al., ASIA CCS 2016 |
| Sequence numbers | The 802.11 sequence counter, which keeps counting across an address change | Vanhoef et al., ASIA CCS 2016 |
| Inter-frame timing | The gaps between probe bursts as the device scans | Matte et al., WiSec 2016 |
| Leaked global address | Frames that still carry the device's real, permanent address | Martin et al., PoPETs 2017 |
| Rotation timing | How often the device changes its address | Fenske et al., PoPETs 2021 |
| Bluetooth payload | Identifiers in the advertisement that change out of step with the Bluetooth address | Becker et al., PoPETs 2019 |
Signal strength distribution and address-prefix similarity add weight, as heuristics without a single source.
- Web UI: Scan tab → Randomized MAC Tracer → Start Scan.
-
Over mesh:
@ALL RANDOMIZATION_START:2:300traces for 300 seconds on both radios.
Each linked device gets an ID of the form T-xxxx. @ALL RANDOMIZATION_RESET clears all tracked devices.
A device block shows the track ID, the vendor, the linked addresses, the confidence score, and which signatures matched. A higher confidence means more signals agreed. A device the tracer has seen only briefly links with lower confidence than one it has watched rotate its address several times.
Lower the number of devices in range, or shorten the trace. Two devices from the same vendor in the same spot, both idle, give the tracer little to tell them apart. A device that never leaks its real address and rotates on a long schedule is the hardest to link.
- Vanhoef, Matte, Cunche, Cardoso, Piessens. Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms. ASIA CCS 2016. doi:10.1145/2897845.2897883
- Matte, Cunche, Rousseau, Vanhoef. Defeating MAC Address Randomization Through Timing Attacks. WiSec 2016. doi:10.1145/2939918.2939930
- Martin et al. A Study of MAC Address Randomization in Mobile Devices and When it Fails. PoPETs 2017(4). doi:10.1515/popets-2017-0054
- Becker, Li, Starobinski. Tracking Anonymized Bluetooth Devices. PoPETs 2019(3). doi:10.2478/popets-2019-0036
- Fenske, Brown, Martin, Mayberry, Ryan, Rye. Three Years Later: A Study of MAC Address Randomization In Mobile Devices And When It Succeeds. PoPETs 2021(3). doi:10.2478/popets-2021-0042