Tracking Unmodified Smartphones Using Wi-Fi Monitorsamusa/papers/slides_musa-sensys12.pdf · mon6...

A.B.M. Musa, Jakob Eriksson

Tracking Unmodified Smartphones Using Wi-Fi Monitors

slide 2

0 1000 2000 3000 4000 5000 6000

10/15

10/22

10/29

11/05

11/12

11/19

11/26

12/03C

ount

Date

A curious pattern...

slide 2

0 1000 2000 3000 4000 5000 6000

10/15

10/22

10/29

11/05

11/12

11/19

11/26

12/03C

ount

Date

A curious pattern...

slide

Organizationally Unique Identifier (OUI)

3

00:0a:27:b7:89:91Apple Computer, Inc.

slide 4

0 2000 4000 6000 8000

10000 12000 14000 16000

Misq

Ford

Nokia

Intel

Cisco

Huaw

ei

Motorola

Murata

HTC

RIM

Apple

Cou

nt

Device Vendor

00:0a:27:b7:89:91

slide

What could it possibly be?

5

slide 6

slide

Could we track them?

7

slide

Could we track them?

7

Trajectory estimation from detections

slide

‣ System overview‣ Trajectory estimation‣ Prompting additional transmissions‣ Tracking coverage and accuracy

8

Outline of the talk

slide

System overview

9

slide

System overview

9

slide

System overview

9

slide

System overview

9

Wi-Fi Prompting

Compact Logging

slide

System overview

9

Wi-Fi Prompting

Compact Logging

slide

System overview

9

Wi-Fi Prompting

Compact Logging

Detections

Trajectory EstimateTrajectory Estimation

Statistics &Analysis

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 50 100 150 200

Cum

ulat

ive

Dis

tribu

tion

Count

mon1mon2mon3mon4mon5mon6mon7

Statistics & Analysis

slide 10

slide

Deployment

11

Permanent 9 months

slide

Deployment

11

2.8 km straightPermanent 9 months

slide

Deployment

11

3.2 km rectangular2.8 km straightPermanent 9 months

slide

Trajectory Estimation

12

slide

The problem at hand...

13

slide

The problem at hand...

13

idealcase

slide

The problem at hand...

13

X

idealcase

nothingreceived

slide

The problem at hand...

13

X

idealcase

nothingreceived

singlepacket

slide

The problem at hand...

13

X

idealcase

nothingreceived

singlepacket

ambiguousreception

slide

The problem at hand...

13

X

idealcase

nothingreceived

singlepacket

ambiguousreception fading and path loss

slide

Straw-man approach

14

slide

Straw-man approach

14

slide

Straw-man approach

14

slide

Straw-man approach

14

slide

Straw-man approach

14

slide

Straw-man approach

14

slide

Straw-man limitations

15

slide

Straw-man limitations

15

slide

Straw-man limitations

15

slide

Straw-man limitations

15

X

slide

Straw-man limitations

15

X

slide

Straw-man limitations

15

X

slide

Straw-man’s limitations

16

slide

Straw-man’s limitations

16

slide

Straw-man’s limitations

16

slide

Straw-man’s limitations

16

slide

Straw-man’s limitations

16

slide

Straw-man’s limitations

16

slide

How to fix our straw-man

17

Impose a graph topology (map) on movements

slide

How to fix our straw-man

17

300 m

Impose a graph topology (map) on movements

Resolve positional ambiguities

slide

The HMM recipe

‣ “hidden” states‣ transition probabilities‣ emission probabilities

18

slide

The HMM recipe

‣ “hidden” states‣ transition probabilities‣ emission probabilities

18

‣ shaken, not stirred

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

States & transition probabilities

19

slide

Emission Probability‣ Probability of observation given a state

(location)‣ Observation: reception/non-reception of a

packet at one or more monitors

20

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

slide

A simple model

21

. . . . . .

. . .

. . .

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

slide 22

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

slide 22

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

slide 22

Experimental RSS characteristics

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

0

0.005

0.01

0.015

0.02

0 50 100 150 200 250 300

PDF

Distance (meters)

SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70

SSI=-70 -

slide

Augmenting detections with RSS

23

slide

Augmenting detections with RSS

23

-55

slide

Augmenting detections with RSS

23

-55 -65

slide

Augmenting detections with RSS

23

-55 -65 -75

slide

Augmenting detections with RSS

23

-55 -65 -75-75

slide

Augmenting detections with RSS

23

-55 -65 -75-75-75

slide

Augmenting detections with RSS

23

-55 -65 -75 -75-75-75

slide

Augmenting detections with RSS

23

-55 -65 -75 -75 -65-75-75

slide

Augmenting detections with RSS

23

-55 -65 -75 -75 -65 -55-75-75

slide

Augmenting detections with RSS

23

-55 -65 -75 -75 -65 -55-75-75

slide

Augmenting detections with RSS

23

-55 -65 -75 -75 -65 -55-75-75

. . .. . .

slide 24

Non-detections are important

slide 24

Non-detections are important

slide 24

Non-detections are important

slide 24

X

Non-detections are important

slide 24

X

Non-detections are important

slide 24

X

Non-detections are important

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide 25

Where

or

p(nondetectionm|s) = 1� p(detectionm|s)

p(obs|s) = p

tx

Y

m2obs

p(em

|s, tx)

em = detectionm em = nondetectionm

p(detectionm

|s, tx) =Z

x

Z

y

p(dist(x, y,m)|RSS)dxdy

Emission probability

slide

Prompting Additional Transmissions

26

slide

Popular AP emulation

27

slide

Popular AP emulation

27

attwifi tmobile

slide

Popular AP emulation

27

attwifi tmobile

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Beacon (TIM=...5...)

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Beacon (TIM=...5...)

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Null function

Beacon (TIM=...5...)

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Data

Null function

Beacon (TIM=...5...)

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Data

Null function

Beacon (TIM=...5...)

slide

Popular AP emulation

27

Association (AID=5)attwifi

tmobile

D D D D D D

Data packets queue

Data

Null function

Beacon (TIM=...5...)

slide 28

Opportunistic AP emulation

slide 28

Opportunistic AP emulation

slide 28

Opportunistic AP emulation

Probe Request (Broadcast)

slide 28

Opportunistic AP emulation

slide 28

Opportunistic AP emulation

Probe Request (MyHomeAP)

slide 28

Opportunistic AP emulation

Probe Request (MyHomeAP)

MyHomeAP security = Open

slide 28

Opportunistic AP emulation

Probe Request (MyHomeAP)

Probe Response (MyHomeAP, Security=Open)

MyHomeAP security = Open

slide 28

Opportunistic AP emulation

Probe Request (MyHomeAP)

Probe Response (MyHomeAP, Security=Open)

MyHomeAP security = Open

slide 28

Opportunistic AP emulationMyHomeAP security = Open

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Probe Request (MyHomeAP)

slide 28

Opportunistic AP emulation

Probe Response (MyHomeAP, Security=WPA2 TKIP)

Probe Response (MyHomeAP, Security=WPA2 CCMP)

MyHomeAP security = WPA2 TKIP

Probe Request (MyHomeAP)

slide 28

Opportunistic AP emulation

Probe Response (MyHomeAP, Security=WPA2 TKIP)

Probe Response (MyHomeAP, Security=WPA2 CCMP)

MyHomeAP security = WPA2 TKIP

slide 28

Opportunistic AP emulation

Probe Response (MyHomeAP, Security=WPA2 TKIP)

Probe Response (MyHomeAP, Security=WPA2 CCMP)

MyHomeAP security = WPA2 TKIP

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Association

4-way handshake

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Association

4-way handshakeX

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Null function (MyHomeAP)

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Null function (MyHomeAP)

Null function (MyHomeAP)

Association

slide 28

Opportunistic AP emulationMyHomeAP security = WPA2 TKIP

Null function (MyHomeAP)

Null function (MyHomeAP)

Association

slide

AP emulation results

29

0

500

1000

1500

2000

2500

3000

attwifi tmobile opportunistic

Cou

nt

AP Type

mon1mon2mon3mon4mon5mon6mon7

slide

RTS injection

30

slide

RTS injection

30

Monitor MAC=E0:...:80

slide

RTS injection

30

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

RTS TX MAC=E0:...:65RX MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

RTS TX MAC=E0:...:65RX MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

RTS TX MAC=E0:...:65RX MAC=7C:...:65

CTSRX MAC=E0:...:80

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

RTS TX MAC=E0:...:65RX MAC=7C:...:65

CTSRX MAC=E0:...:80

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

RTS injection

30

Probe Request (Broadcast)TX MAC=7C:...:65

RTS TX MAC=F6:...:65RX MAC=7C:...:65

CTSRX MAC=F6:...:65

Monitor MAC=E0:...:80 Phone MAC=7C:...:65

F6:...:65 = 7C:...:65

slide

Performance of probing techniques

31

Mean Duration

Popular AP emulation: 31 seconds Opportunistic AP emulation: 24 secondsRTS injection: 2 seconds

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Encounter duration

32

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Number of Seconds

Passive monitoringWith Prompting

slide

Tracking Performance

33

slide

Experimental setup

‣ 12 hour deployment of 7 monitors along 2.8 km city street

‣ Drove and walked several times with some smartphones and GPS

34

slide

Movie time!

35

slide

Distance error

36

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 50 100 150 200 250 300

Cum

ulat

ive

Dis

tribu

tion

Distance Error (meters)

DrivingWalking

slide

Distance error

36

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 50 100 150 200 250 300

Cum

ulat

ive

Dis

tribu

tion

Distance Error (meters)

DrivingWalking

slide

How many cars do we detect?

37

12 hour deployment7000 unique devices

37000 ADT according to DOT

slide

How many cars do we detect?

37

12 hour deployment7000 unique devices

37000 ADT according to DOT

19%

slide

A mystery for you...

38

0 2000 4000 6000 8000

10000 12000 14000 16000

Misq

Ford

Nokia

Intel

Cisco

Huaw

ei

Motorola

Murata

HTC

RIM

Apple

Cou

nt

Device Vendor

slide

A mystery for you...

38

Unlisted

0 2000 4000 6000 8000

10000 12000 14000 16000

Misq

Ford

Nokia

Intel

Cisco

Huaw

ei

Motorola

Murata

HTC

RIM

Apple

Cou

nt

Device Vendor

slide

Conclusions‣ Smartphone Wi-Fi is chatty and trackable‣ HMM Trajectory estimation from detections ‣ Several probing techniques- Potentially increases detections- Certainly increases received packets‣ Good tracking accuracy - Enables real world applications

39

slide

Thank you!

40

Questions?

slide

Speed estimate example

41

0

5

10

15

20

25

30

35

10:00 18:00

Spee

d (k

m/h

)

Hour of Day

EastboundWestbound

slide

Graceful degradation

42

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 50 100 150 200 250 300 350

Cum

ulat

ive

Dis

tribu

tion

Distance Error (meters)

No removalMonitor 4 removed

Monitors 3,5 removedMonitors 3,4,5 removed

7 6 5 4 3 2 1

slide

Unlisted MACs

43

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 20 40 60 80 100

Cum

ulat

ive

Dis

tribu

tion

Monitor Percentage

Listed MACsUnlisted MACs

slide

Opportunistic AP emulation

Probe RequestProbe Response

Open System AuthOpen System Auth

Association RequestAssociation Response

4-way handshake

null function

44