Hi All,
How to i determine geolocation of access point based on Wireshark capture. Is there way to find out from the pcap capture . Kindly advise. Thanks.
There's nothing in Wireshark itself, but SSIDs and MAC addresses can be used to look an AP up in a database. See the Wikipedia page on WiFi Positioning System.
If the capture includes a public IP address for the access point, try GeoIP:
Wireshark Wiki: How To Use GeoIP With Wireshark
GeoIP Mapping in Wireshark
You can get a general area of the geolocation with the AP ISP gateway address. It is the best interest of the ISP for the gateway to be nearby to avoid latency and throughput issues. The ISP gateway should be nearby and there are multiple tools like What is my IP that you can help pinpoint the city.
Comments