Tracking Unmodified Smartphones Using Wi-Fi Monitorsamusa/papers/slides_musa-sensys12.pdf · mon6...
Transcript of Tracking Unmodified Smartphones Using Wi-Fi Monitorsamusa/papers/slides_musa-sensys12.pdf · mon6...
A.B.M. Musa, Jakob Eriksson
Tracking Unmodified Smartphones Using Wi-Fi Monitors
slide 2
0 1000 2000 3000 4000 5000 6000
10/15
10/22
10/29
11/05
11/12
11/19
11/26
12/03C
ount
Date
A curious pattern...
slide 2
0 1000 2000 3000 4000 5000 6000
10/15
10/22
10/29
11/05
11/12
11/19
11/26
12/03C
ount
Date
A curious pattern...
slide
Organizationally Unique Identifier (OUI)
3
00:0a:27:b7:89:91Apple Computer, Inc.
slide 4
0 2000 4000 6000 8000
10000 12000 14000 16000
Misq
Ford
Nokia
Intel
Cisco
Huaw
ei
Motorola
Murata
HTC
RIM
Apple
Cou
nt
Device Vendor
00:0a:27:b7:89:91
slide
What could it possibly be?
5
slide 6
slide
Could we track them?
7
slide
Could we track them?
7
Trajectory estimation from detections
slide
‣ System overview‣ Trajectory estimation‣ Prompting additional transmissions‣ Tracking coverage and accuracy
8
Outline of the talk
slide
System overview
9
slide
System overview
9
slide
System overview
9
slide
System overview
9
Wi-Fi Prompting
Compact Logging
slide
System overview
9
Wi-Fi Prompting
Compact Logging
slide
System overview
9
Wi-Fi Prompting
Compact Logging
Detections
Trajectory EstimateTrajectory Estimation
Statistics &Analysis
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 50 100 150 200
Cum
ulat
ive
Dis
tribu
tion
Count
mon1mon2mon3mon4mon5mon6mon7
Statistics & Analysis
slide 10
slide
Deployment
11
Permanent 9 months
slide
Deployment
11
2.8 km straightPermanent 9 months
slide
Deployment
11
3.2 km rectangular2.8 km straightPermanent 9 months
slide
Trajectory Estimation
12
slide
The problem at hand...
13
slide
The problem at hand...
13
idealcase
slide
The problem at hand...
13
X
idealcase
nothingreceived
slide
The problem at hand...
13
X
idealcase
nothingreceived
singlepacket
slide
The problem at hand...
13
X
idealcase
nothingreceived
singlepacket
ambiguousreception
slide
The problem at hand...
13
X
idealcase
nothingreceived
singlepacket
ambiguousreception fading and path loss
slide
Straw-man approach
14
slide
Straw-man approach
14
slide
Straw-man approach
14
slide
Straw-man approach
14
slide
Straw-man approach
14
slide
Straw-man approach
14
slide
Straw-man limitations
15
slide
Straw-man limitations
15
slide
Straw-man limitations
15
slide
Straw-man limitations
15
X
slide
Straw-man limitations
15
X
slide
Straw-man limitations
15
X
slide
Straw-man’s limitations
16
slide
Straw-man’s limitations
16
slide
Straw-man’s limitations
16
slide
Straw-man’s limitations
16
slide
Straw-man’s limitations
16
slide
Straw-man’s limitations
16
slide
How to fix our straw-man
17
Impose a graph topology (map) on movements
slide
How to fix our straw-man
17
300 m
Impose a graph topology (map) on movements
Resolve positional ambiguities
slide
The HMM recipe
‣ “hidden” states‣ transition probabilities‣ emission probabilities
18
slide
The HMM recipe
‣ “hidden” states‣ transition probabilities‣ emission probabilities
18
‣ shaken, not stirred
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
States & transition probabilities
19
slide
Emission Probability‣ Probability of observation given a state
(location)‣ Observation: reception/non-reception of a
packet at one or more monitors
20
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
slide
A simple model
21
. . . . . .
. . .
. . .
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
slide 22
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
slide 22
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
slide 22
Experimental RSS characteristics
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
0
0.005
0.01
0.015
0.02
0 50 100 150 200 250 300
Distance (meters)
SSI=-40 +SSI=-40 to -50SSI=-50 to -60SSI=-60 to -70
SSI=-70 -
slide
Augmenting detections with RSS
23
slide
Augmenting detections with RSS
23
-55
slide
Augmenting detections with RSS
23
-55 -65
slide
Augmenting detections with RSS
23
-55 -65 -75
slide
Augmenting detections with RSS
23
-55 -65 -75-75
slide
Augmenting detections with RSS
23
-55 -65 -75-75-75
slide
Augmenting detections with RSS
23
-55 -65 -75 -75-75-75
slide
Augmenting detections with RSS
23
-55 -65 -75 -75 -65-75-75
slide
Augmenting detections with RSS
23
-55 -65 -75 -75 -65 -55-75-75
slide
Augmenting detections with RSS
23
-55 -65 -75 -75 -65 -55-75-75
slide
Augmenting detections with RSS
23
-55 -65 -75 -75 -65 -55-75-75
. . .. . .
slide 24
Non-detections are important
slide 24
Non-detections are important
slide 24
Non-detections are important
slide 24
X
Non-detections are important
slide 24
X
Non-detections are important
slide 24
X
Non-detections are important
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide 25
Where
or
p(nondetectionm|s) = 1� p(detectionm|s)
p(obs|s) = p
tx
Y
m2obs
p(em
|s, tx)
em = detectionm em = nondetectionm
p(detectionm
|s, tx) =Z
x
Z
y
p(dist(x, y,m)|RSS)dxdy
Emission probability
slide
Prompting Additional Transmissions
26
slide
Popular AP emulation
27
slide
Popular AP emulation
27
attwifi tmobile
slide
Popular AP emulation
27
attwifi tmobile
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Beacon (TIM=...5...)
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Beacon (TIM=...5...)
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Null function
Beacon (TIM=...5...)
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Data
Null function
Beacon (TIM=...5...)
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Data
Null function
Beacon (TIM=...5...)
slide
Popular AP emulation
27
Association (AID=5)attwifi
tmobile
D D D D D D
Data packets queue
Data
Null function
Beacon (TIM=...5...)
slide 28
Opportunistic AP emulation
slide 28
Opportunistic AP emulation
slide 28
Opportunistic AP emulation
Probe Request (Broadcast)
slide 28
Opportunistic AP emulation
slide 28
Opportunistic AP emulation
Probe Request (MyHomeAP)
slide 28
Opportunistic AP emulation
Probe Request (MyHomeAP)
MyHomeAP security = Open
slide 28
Opportunistic AP emulation
Probe Request (MyHomeAP)
Probe Response (MyHomeAP, Security=Open)
MyHomeAP security = Open
slide 28
Opportunistic AP emulation
Probe Request (MyHomeAP)
Probe Response (MyHomeAP, Security=Open)
MyHomeAP security = Open
slide 28
Opportunistic AP emulationMyHomeAP security = Open
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Probe Request (MyHomeAP)
slide 28
Opportunistic AP emulation
Probe Response (MyHomeAP, Security=WPA2 TKIP)
Probe Response (MyHomeAP, Security=WPA2 CCMP)
MyHomeAP security = WPA2 TKIP
Probe Request (MyHomeAP)
slide 28
Opportunistic AP emulation
Probe Response (MyHomeAP, Security=WPA2 TKIP)
Probe Response (MyHomeAP, Security=WPA2 CCMP)
MyHomeAP security = WPA2 TKIP
slide 28
Opportunistic AP emulation
Probe Response (MyHomeAP, Security=WPA2 TKIP)
Probe Response (MyHomeAP, Security=WPA2 CCMP)
MyHomeAP security = WPA2 TKIP
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Association
4-way handshake
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Association
4-way handshakeX
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Null function (MyHomeAP)
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Null function (MyHomeAP)
Null function (MyHomeAP)
Association
slide 28
Opportunistic AP emulationMyHomeAP security = WPA2 TKIP
Null function (MyHomeAP)
Null function (MyHomeAP)
Association
slide
AP emulation results
29
0
500
1000
1500
2000
2500
3000
attwifi tmobile opportunistic
Cou
nt
AP Type
mon1mon2mon3mon4mon5mon6mon7
slide
RTS injection
30
slide
RTS injection
30
Monitor MAC=E0:...:80
slide
RTS injection
30
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
RTS TX MAC=E0:...:65RX MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
RTS TX MAC=E0:...:65RX MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
RTS TX MAC=E0:...:65RX MAC=7C:...:65
CTSRX MAC=E0:...:80
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
RTS TX MAC=E0:...:65RX MAC=7C:...:65
CTSRX MAC=E0:...:80
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
RTS injection
30
Probe Request (Broadcast)TX MAC=7C:...:65
RTS TX MAC=F6:...:65RX MAC=7C:...:65
CTSRX MAC=F6:...:65
Monitor MAC=E0:...:80 Phone MAC=7C:...:65
F6:...:65 = 7C:...:65
slide
Performance of probing techniques
31
Mean Duration
Popular AP emulation: 31 seconds Opportunistic AP emulation: 24 secondsRTS injection: 2 seconds
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Encounter duration
32
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Number of Seconds
Passive monitoringWith Prompting
slide
Tracking Performance
33
slide
Experimental setup
‣ 12 hour deployment of 7 monitors along 2.8 km city street
‣ Drove and walked several times with some smartphones and GPS
34
slide
Movie time!
35
slide
Distance error
36
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 50 100 150 200 250 300
Cum
ulat
ive
Dis
tribu
tion
Distance Error (meters)
DrivingWalking
slide
Distance error
36
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 50 100 150 200 250 300
Cum
ulat
ive
Dis
tribu
tion
Distance Error (meters)
DrivingWalking
slide
How many cars do we detect?
37
12 hour deployment7000 unique devices
37000 ADT according to DOT
slide
How many cars do we detect?
37
12 hour deployment7000 unique devices
37000 ADT according to DOT
19%
slide
A mystery for you...
38
0 2000 4000 6000 8000
10000 12000 14000 16000
Misq
Ford
Nokia
Intel
Cisco
Huaw
ei
Motorola
Murata
HTC
RIM
Apple
Cou
nt
Device Vendor
slide
A mystery for you...
38
Unlisted
0 2000 4000 6000 8000
10000 12000 14000 16000
Misq
Ford
Nokia
Intel
Cisco
Huaw
ei
Motorola
Murata
HTC
RIM
Apple
Cou
nt
Device Vendor
slide
Conclusions‣ Smartphone Wi-Fi is chatty and trackable‣ HMM Trajectory estimation from detections ‣ Several probing techniques- Potentially increases detections- Certainly increases received packets‣ Good tracking accuracy - Enables real world applications
39
slide
Thank you!
40
Questions?
slide
Speed estimate example
41
0
5
10
15
20
25
30
35
10:00 18:00
Spee
d (k
m/h
)
Hour of Day
EastboundWestbound
slide
Graceful degradation
42
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 50 100 150 200 250 300 350
Cum
ulat
ive
Dis
tribu
tion
Distance Error (meters)
No removalMonitor 4 removed
Monitors 3,5 removedMonitors 3,4,5 removed
7 6 5 4 3 2 1
slide
Unlisted MACs
43
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9
1
0 20 40 60 80 100
Cum
ulat
ive
Dis
tribu
tion
Monitor Percentage
Listed MACsUnlisted MACs
slide
Opportunistic AP emulation
Probe RequestProbe Response
Open System AuthOpen System Auth
Association RequestAssociation Response
4-way handshake
null function
44