Home page logo
/

nmap-dev logo Nmap Development mailing list archives

[NSE] mac-geolocation : BSSID (MAC) address based geolocation of WiFi access points
From: Gorjan Petrovski <mogi57 () gmail com>
Date: Sun, 22 May 2011 09:52:50 +0200

Hello,

Here is the mac-geolocation script which queries the Google and
Skyhook geolocation services for a location, using the BSSID (MAC)
address of a WiFi access point.

  Google Geolocation lookup related information:
When given a wrong MAC address, or a nonexistant MAC the Google API for
geolocation of MAC addresses makes an IP geolocation of the host which is
making the geolookup request (which is us). This IP based geolookup generates
a response which has an accuracy field containing a high value (meaning low
accuracy). So, in order to separate the MAC-based responses from the IP-based
ones, we do a lookup of a non-valid MAC address "00", and compare all the
results with that one: if the results match, and the accuracy is larger than
2000 (meters?) than it's probably safe to say that the geolookup was made
based on our IP address.
Google Geolocation API Protocol:
http://code.google.com/apis/gears/geolocation_network_protocol.html

  Skyhook Geolocation lookup related information:
The Skyhook API used here is not officially documented by Skyhook. Skyhook
API does not return results for a MAC lookup if the country containing the
results is different from our country (country of the host querying the API)

Because of this, and the slow process of updating the Skyhook
database, I've not yet been able to test the Skyhook-based lookup, so
would someone living in the US please test it against a MAC address
which he knows that is in the Skyhook database?
Thanks!

Should I shorten the output, or add a Google Maps link?
The output currently looks like this:
| mac-geolocation:
|   00:24:B2:1E:24:FE
|     Google
|       longitude: -93.100682
|       latitude: 44.9507415
|       accuracy: 1025
|       address:
|         city: "St Paul"
|         country: "United States"
|         county: "Ramsey"
|         country_code: "US"
|         region: "Minnesota"
|     SkyHook
|       longitude: -93.100682
|       latitude: 44.9507415
|       address:
|         street-number:
|         address-line:
|         city: "St Paul"
|         postal-code:
|         county: "Ramsey"
|_        state: "Minnesota"

All comments are welcomed :-)

Cheers,
Gorjan

Attachment: mac-geolocation.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault