Intro
You've grown paranoid of people who could be stealing your Wifi ?You have the securest form of Wifi encryption ... still wouldn't you like to know STRAIGHT AWAY if someone managed to crack into your network?
Here's a home baked solution ( not suitable for work ) your mileage may vary depending on your Wifi access point.
Concept
Every 5 minutes, a script checks your Wifi access point for unknown Wifi devices.If one of these devices isn't included in a list of Wifi devices you defined, you get an alert on your iPad/iPhone every day until you add it to your list of known Wifi devices.
Requirements
- Raspberry Pi running RaspBMC, powered on & connected to your Wifi 24/7
- Prowl
- Prowl API key
- iOS device - iPhone/iPad
- understanding of Bash/shell scripting
- you need to make a list of your wifi devices as csv
echo "device_owner;device_name;00:23:68:BE:E7:62" >> known_wifi_devices.csv
You need to understand how to get MAC addresses from your modem/router - i have a Zhone router with Adamo, not much I can help you with here, you need to master curl and grep !
The script
nano rogue_devices.sh
# check if all Wifi devices on the router are known MAC addresses
# if unknown, send a notification via Prowl
# run this as "cron job"
APIKEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#get the list of MAC addresses from the webpage of my Wifi access point.
html=$(curl -u user:user http://192.168.1.1/wlstationlist.cmd)
echo "$html" | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}'| while read mac
do
# check if MAC address is known
if grep -i -q $mac /home/pi/known_wifi_devices.csv; then
echo "OK - $mac is known wifi device"
else
#if station in logfile in the last day, just log it.
if grep -E "^$(/bin/date +"%a %b %d")..............$(/bin/date +"%Y")" -q /var/log/rogue_wifi_monitor; then
echo "$(/bin/date +"%a %b %d %T %Z %Y") --- $mac is not a known Wifi device on this network" | tee -a /var/log/rogue_wifi_monitor
else # log it and notify via Prowl
echo "$(/bin/date +"%a %b %d %T %Z %Y") --- $mac is not a known Wifi device on this network, admin notified" | tee -a /var/log/rogue_wifi_monitor
curl https://api.prowlapp.com/publicapi/add \
-F apikey=$APIKEY \
-F application="XBMC Rpi" \
-F event="Rogue Wifi device detected" \
-F description="MAC Address $mac is unknown !"
fi
fi
done
Configure cron
Configure Cron for the script to run every 5 minutes.crontab -e
*/5 * * * * /home/pi/rogue_devices.sh
If you're curious about what 'cron' does, I recommend this tutorial
Enable cron
Since cron is disabled in RaspBMC, you must enable it.nano .xbmc/userdata/addon_data/script.raspbmc.settings/settings.xml
change sys.service.cron to "true"
Start cron
service cron start
Possible improvements
rotate or truncate log filelog when Wifi device is recognized after being added.
