37

I have an Angstrom Linux device acting as an access point, running hostapd, dhcpd, which works fine. Can I get a list of devices connected to the Wi-Fi? I know I can get the DHCP leases, but I need to know which devices connect through wlan0. I've tried this (iwlist has options):

iwlist wlan0 ap
iwlist wlan0 accesspoints
iwlist wlan0 peers

but all return:

wlan0     Interface doesn't have a list of Peers/Access-Points

iwconfig, iwgetid, iwpriv and iwspy are also present in /sbin, but don't seem to have options to display the client list.

8 Answers 8

41

You should use iw dev wlan0 station dump as root

6
  • Thanks - I don't see this for my Arm 9 Angstrom yet, but I'll go look for it
    – Jeff
    Jun 10, 2012 at 15:04
  • Perhaps you can compile from source, assuming you have enough space or a CF for temporary storage Jun 10, 2012 at 22:01
  • 2
    iw also depends on nl80211 support in the WiFi interface's driver - which is not present for all drivers yet... wireless.wiki.kernel.org/en/developers/documentation/nl80211
    – Pierz
    Nov 30, 2016 at 17:51
  • In case you have more than one devices, for example when having 2.4 GHz and 5GHz enabled, you might get an empty results back. This is an indicator that no client has connected to the specify interface or frequency.
    – Akendo
    Jul 5, 2018 at 8:31
  • Also i think that if you have wlan0.staX (certain wds/multiap/4addr configs) you would need to specify that interface for all staX interfaces
    – nhed
    Jun 5, 2021 at 1:17
12

You could Use "arp" as root:

$ sudo arp

or:

$ sudo arp | sort 

kinda nicer, but you got the point :)

5
  • 1
    Not sure why should this be downvoted, it does show what kind of clients (IP and MAC) are connected
    – psukys
    Dec 10, 2014 at 11:18
  • 4
    It is downvoted because arp returns only hosts that are active on the network in the arp table on the host. If someone nasty associates with the AP and is passively sniffing they will never show up in the arp table.
    – Geoffrey
    Jul 18, 2015 at 11:57
  • 2
    You don't need superuser privileges to dump the arp table. See also ip n on Linux. Apr 17, 2018 at 10:17
  • 1
    Didn't work for me. I call arp but it only contains entries for ethernet. If i use arp -i wlan0 nothing is shown. With iw dev wlan0 station dump it is working. Dec 6, 2018 at 13:24
  • 1
    arp is really just a mapping from L3 (IP) to L2 (MAC) addresses. Deriving any information about connected stations is wrong. Its a wrong place to look. An could be a strict layer2 device and pass traffic without ever knowing the IP address of the AP. So down-voting.
    – nhed
    Jan 7, 2021 at 20:14
5

You can also find list of connected devices to your AP by using this command:

cat /var/lib/misc/dnsmasq.leases

dnsmasq.leases file lists all the devices which connected to AP so far. Also you can get list of all devices which connected to your device over WiFi or Ethernet by using this command:

sudo arp
2
  • 1
    That would be on systems that use dnsmasq as a DHCP server. The OP uses "dhcpd", presumably the ISC implementation. Also stations could associate and not request and DHCP lease or not send any IP or ARP traffic. Apr 17, 2018 at 10:20
  • 1
    AP does not need to be a DHCP server nor does it even need to understand/talk in IP, so both your suggestions are off
    – nhed
    Jan 7, 2021 at 20:17
3

arp-scan

As said on this answer you can use arp-scan package. Just arp-scan -l.

arp-scan is a command-line tool for system discovery and fingerprinting. It constructs and sends ARP requests to the specified IP addresses, and displays any responses that are received.

With systemd/udev names I found very useful an alias to

sudo arp-scan -l -t 200 -I $(ls /sys/class/net | grep -o "wl[^\t]\+")

for the wireless interface and en instead of wl for wired interfaces.

  • -I --interface Use network interface . If this option is not specified, arp-scan will search the system interface list for the lowest numbered, configured up interface (excluding loopback).
  • -l --localnet Generate addresses from network interface configuration. Use the network interface IP address and network mask to generate the list of target host addresses.
  • -t --timeout Set initial per host timeout to ms, default=100. This timeout is for the first packet sent to each host.

To read the arp cache table cool kids nowadays use ip neighbor.

1

I use something like this fast solution:

awk '$4~/[1-9a-f]+/&&$6~/^wl/{print "ip: "$1" mac: "$4}' /proc/net/arp

The /[1-9a-f]/ filter removes MAC addresses like 00:00:00... from listing.

The /^wl/ filter removes all non-wireless interfaces (without "wl" at the beginning of their names).

The example result is:

ip: 192.168.0.1 mac: 64:6e:ea:d1:d3:0a
ip: 192.168.0.2 mac: a0:d3:a1:6d:d0:4a

Also, for my convenience, I use a file macs with list of mac addresses of this context:

90:94:97:9f:85:10 My Huawei
64:6e:ea:d1:d3:0a Rostelecom Router

To get a list of connected devices with parsing this file I use such command (the END section is unnecessary - it's an updater):

awk 'BEGIN{while((getline<"macs")>0){nmm=$0;gsub($1" ","",nmm);nmz[$1]=nmm}}$4~/[1-9a-f]+/&&$6~/^wl/{print $1 " " (nmz[$4]?nmz[$4]:$4);if(!nmz[$4]){nmz[$4]=$4;update=1}}END{if(update){system("gawk -f macupd.awk")}}' /proc/net/arp

So in this way the result will be:

192.168.0.1 Rostelecom Router
192.168.0.74 My Huawei

The macupd.awk is the script for updating macs file. It gets vendor names from file oui.txt (located in the same directory) and uses them as descriptions of unknown hosts/clients connected to your machine and writes them to the macs list file (you may disable this by removing END section from command). Here is the script:

#!/usr/bin/gawk -f
BEGIN{
    while((getline<"macs")>0){
        str++
        if($0!~"(^#|^$)"){
            nam=$0
            gsub($1" ","",nam)
            macnamz[$1]=nam
        }
    }

    while((getline<"/proc/net/arp")>0){
        if($4~/[1-9a-f]+/&&$6~/^wl/){
            if(!macnamz[$4]){
                mac=macv=$4
                gsub(":","",macv)
                vendor=substr(macv,1,6)
                rs=RS
                RS="\n|\r"
                while((getline<"oui.txt")>0){
                    if(toupper($1)~toupper(vendor)){gsub(/.*\t+/,"");macnamz[mac]=$0;update=1}
                }
                RS=rs
            }
        }
    }
    if(update){
        for(i in macnamz){print i " " macnamz[i] > "macs"}
        print "" > "macs"
    }
}

So if in the first running of my imperfect command the result will be (if all hosts where unknown):

192.168.10.1 00:d0:ef:aa:ee:ff
192.168.10.2 f4:bd:9e:00:00:00
192.168.10.3 00:22:72:11:22:33

The second running will be such:

192.168.10.1 IGT
192.168.10.2 Cisco Systems, Inc
192.168.10.3 American Micro-Fuel Device Corp.

The description of my script.

getline<"macs" - Reading lines from list

if($0!~"(^#|^$)") - Ignoring commented and empty lines.

gsub($1" ","",nam) - I used nam variable for description (everything after space).

macnamz[$1]=nam - Final conversion of line to a part of associative array (there can not be 2 duplicated MACs - 2nd will overwrite 1st).

getline<"/proc/net/arp" - Getting connected IPs and MACs.

if($4~/[1-9a-f]+/&&$6~/^wl/) - Filtering out header line, zero MACs, and non-wireless interfaces.

if(!macnamz[$4]) - If connected device is not registered in our macs file.

gsub(":","",macv) and vendor=substr(macv,1,6) - Getting first 6 symbols of MAC.

RS="\n|\r" - Because oui.txt may have MS Windows line endings.

gsub(/.*\t+/,"") - Removing tabs

macnamz[mac]=$0 - Converting line to an array member.

update=1 - This variable says that updating of file is necessary (if it is).

2
  • 1
    Doesn't this also list devices connected by wired interfaces? I just tried on a non-WiFi machine, and got results corresponding to its Ethernet interfaces. Perhaps we need$6 ~ /wlan/ as the condition instead. Note, your version also misses some addresses - the char group should be [0-9a-f]. Dec 15, 2021 at 8:26
  • Does. If you want to show only wi-fi connections use '$4~/[1-9]+/&&$6~/^wl/' (my wlan device name is wlo1). My solution shows all connected network devices (your router and your clients) with ip and mac.The "[1-9]" I use to filter such: 00:00:00:00... mac addresses. So I'm not wrong :-) (a little bit wrong! "[1-9a-f]" will be correct). Maybe the 0x2 flag is router and 0x0 is client, I don't know. In my case it is.
    – Evgeny
    Dec 15, 2021 at 9:05
0

the accepted answer is of course correct but some systems might be too old (or some drivers) for iw

if you have hostapd you probably also have hostapd_cli, so you can try

hostapd_cli list_sta

I down-voted any answer that was not iw because they rely on traffic actually traversing the link. Getting a list of think connected to your wifi should not depend on those things making higher level (OSI model-wise).

-1

There is also a free (commercial licence, unlimited duration trial with maximum of 5 devices displayed) GUI application, WifiGuard.

1
  • WifiGuard is for Windows and macOS only.
    – dr_
    Dec 15, 2021 at 10:29
-2

On Ubuntu, After starting the hotspots by clicking in WiFi top right of screen in gnome, select WiFi and "Wi-Fi Settings", config opens, select hamburger top right in menu, "Turn On Wi-Fi Hotspot..."

In terminal display connected clients by running in superuser mode :

iw dev wlan0 station dump
2
  • 1
    how does this answe differ from the accepted one - that was submitted years before yours?
    – nhed
    Mar 31, 2021 at 20:39
  • it explains how to enable hotspots through the gui
    – Pieter
    Jun 16, 2021 at 23:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.