Count the number of people around you 👨‍👨‍👦 by monitoring wifi signals 📡 .

Last update: Jan 07, 2023

Related tags

Overview

howmanypeoplearearound

Count the number of people around you 👨‍👨‍👦 by monitoring wifi signals 📡 .

howmanypeoplearearound calculates the number of people in the vicinity using the approximate number of smartphones as a proxy (since ~70% of people have smartphones nowadays). A cellphone is determined to be in proximity to the computer based on sniffing WiFi probe requests. Possible uses of howmanypeoplearearound include: monitoring foot traffic in your house with Raspberry Pis, seeing if your roommates are home, etc.

Tested on Linux (Raspbian and Ubuntu) and Mac OS X.

It may be illegal to monitor networks for MAC addresses, especially on networks that you do not own. Please check your country's laws (for US Section 18 U.S. Code § 2511) - discussion.

Getting started

For a video walkthrough on how to install, checkout PNPtutorials.

Dependencies

Python 2.7 or preferably Python 3 must be installed on your machine with the pip command also available.

  python -V
  pip -V

WiFi adapter that supports monitor mode

There are a number of possible USB WiFi adapters that support monitor mode. Here's a list that are popular:

Namely you want to find a USB adapter with one of the following chipsets: Atheros AR9271, Ralink RT3070, Ralink RT3572, or Ralink RT5572.

Mac OS X

  brew install wireshark
  brew cask install wireshark-chmodbpf

You need to dissociate from any AP before initiating the scanning:

sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -z

Linux tshark

sudo apt-get install tshark

Then update it so it can be run as non-root:

sudo dpkg-reconfigure wireshark-common     (select YES)
sudo usermod -a -G wireshark ${USER:-root}
newgrp wireshark

Install

pip install howmanypeoplearearound

Run

Quickstart

To run, simply type in

$ howmanypeoplearearound
Using wlan1 adapter and scanning for 60 seconds...
[==================================================] 100%        0s left
There are about 3 people around.

You will be prompted for the WiFi adapter to use for scanning. Make sure to use an adapter that supports "monitor" mode.

Docker alternative

If Docker is installed locally and you want to take howmanypeoplearearound out for a quick spin, you can try the following:

Copy Dockerfile from this repo in your current working directory
docker build -t howmanypeoplearearound . # that . at the end is important
docker run -it --net=host --name howmanypeoplearearound howmanypeoplearearound

NOTE: This Docker alternative is known to work on Ubuntu but not on Mac OS X. Feedback on other platforms would be appreciated.

Options

You can modify the scan time, designate the adapter, or modify the output using some command-line options.

$ howmanypeoplearearound --help

Options:
  -a, --adapter TEXT   adapter to use
  -z, --analyze TEXT   analyze file
  -s, --scantime TEXT  time in seconds to scan
  -o, --out TEXT       output cellphone data to file
  -v, --verbose        verbose mode
  --number             just print the number
  -j, --jsonprint      print JSON of cellphone data
  -n, --nearby         only quantify signals that are nearby (rssi > -70)
  --nocorrection       do not apply correction
  --loop               loop forever
  --sort               sort cellphone data by distance (rssi)

Print JSON

You can generate an JSON-formatted output to see what kind of phones are around:

$ howmanypeoplearearound -o test.json -a wlan1
[==================================================] 100%         0s left
There are about 4 people around.
$ cat test.json | python3 -m json.tool
[
  {
    "rssi": -86.0,
    "mac": "90:e7:c4:xx:xx:xx",
    "company": "HTC Corporation"
  },
  {
    "rssi": -84.0,
    "mac": "80:e6:50:xx:xx:xx",
    "company": "Apple, Inc."
  },
  {
    "rssi": -49.0,
    "mac": "ac:37:43:xx:xx:xx",
    "company": "HTC Corporation"
  }
]

A higher rssi means closer (one of these phones is mine, and the other two are my roommates' who were upstairs).

Run forever

You can add --loop to make this run forever and append new lines an output file, test.json:

$ howmanypeoplearearound -o test.json -a wlan1 --loop

Visualize

You can visualize the output from a looped command via a browser using:

$ howmanypeoplearearound --analyze test.json 
Wrote index.html
Open browser to http://localhost:8001
Type Ctl+C to exit

Then just open up index.html in a browser and you should see plots. The first plot shows the number of people over time. Here you can see that people start arriving at work place around 8-9am (when work starts!).

The second plot shows the RSSI values for the mac addresses seen. You can double-click on one of them in particular to highlight that trajectory, as I have done here for my phone (you can see when I leave from and when I arrive to work!):

How does it work?

howmanypeoplearearound counts up the number of probe requests coming from cellphones in a given amount of time. The probe requests can be "sniffed" from a monitor-mode enabled WiFi adapter using tshark. An accurate count does depend on everyone having cellphone and also scanning long enough (1 - 10 minutes) to capture the packet when a phone pings the WiFi network (which happens every 1 to 10 minutes unless the phone is off or WiFi is disabled).

This is a simplification of another program I wrote, find-lf which uses a similar idea with a cluster of Raspberry Pis to geolocate positions of cellphones within the vicinity.

License

MIT

Comments

What is legality of monitoring traffic for mac addresses

Hey, nice job on this :) I just wanted to mention that in case you are not aware, it is against the law to sniff packets. The only exception is to sniff on your own network, and only to protect it.

It is unfortunate, otherwise it would be really nice to come up with ways to use it!

At least you should put a "big fat" warning that the use of sniffing is most likely be illegal.
question

opened by kootenpv 22
Create Dockerfile
Trying to fix https://github.com/schollz/howmanypeoplearearound/issues/6 This does the full build but does not provide any data packets on my Mac but maybe others will have more luck on more promiscuous OSes.

To use:

$ docker build -t howmanypeoplearearound .

$ docker run -it --rm --name howmanypeoplearearound howmanypeoplearearound
opened by cclauss 4
Will it detect only certain cellphones

Help needed- Does its detect only phones listed in the code? It detects wonderfully my HTC phone, but not OnePlus, MI or Xiomi phone.

Issue - The count of cellphones takes into account rssi~0 also, which seems to be incorrect output.

opened by AshayAgrawal 4
Added CLI option to specify the pcap flie

This can be helpful on MacOS where you can capture on the interface while still attached to the wifi (using the Wireless Diagnostic tool) or in general when you already have a pcap file.

opened by asutoshpalai 3
Video Tutorials

It's basically self explanatory but still there are very less video explainations,kindly add some video Tutorials as there are many noobs and this project is very cool
help wanted hacktoberfest

opened by AlistairXX 3
Most Basic Hardware Implementation

What is the simplest standalone hardware setup you would recommend for this?

What service would you run to be able to access the graphed results on another device's web browser?

opened by adamsiem 3
Use newgrp to avoid log out and log back in

https://ask.wireshark.org/questions/7976/wireshark-setup-linux-for-nonroot-user This approach is used in the Dockerfile

Also verify that Python and pip are installed.

opened by cclauss 3

No such command (analyze, loop, etc)

When I try to use analyze or loop as per the instructions, it says no such command. Some of the other ones work, and when I pull up the help info, it only lists these:


  -a, --adapter TEXT   adapter to use
  -s, --scantime TEXT  time in seconds to scan
  -o, --out TEXT       output cellphone data to file
  -v, --verbose        verbose mode
  --number             just print the number
  -j, --jsonprint      print JSON of cellphone data
  -n, --nearby         only quantify signals that are nearby (rssi > -70)
  --nocorrection       do not apply correction
  --help               Show this message and exit.

Any ideas?

opened by hunsbct 2

Is rssi calculation correct?

https://github.com/schollz/howmanypeoplearearound/blob/master/howmanypeoplearearound/main.py#L159-L161 Is this correct? It probably is correct, and my knowledge is weak. :-(

opened by cclauss 2
ModuleNotFoundError: No module named '_curses'

I am using python 3 on windows, run command in command line like this: pip install howmanypeoplearearound and finally it shows: Successfully installed howmanypeoplearearound-0.3.1 netifaces-0.10.5 pick-0.6.3 However, when run command: howmanypeoplearearound failed: Traceback (most recent call last): File "C:\Users\win10\AppData\Local\Programs\Python\Python36-32\Scripts\howmanypeoplearearound-script.py", line 11, in <module> load_entry_point('howmanypeoplearearound==0.3.1', 'console_scripts', 'howmanypeoplearearound')() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 560, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2648, in load_entry_point return ep.load() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2302, in load return self.resolve() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2308, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\howmanypeoplearearound\__main__.py", line 11, in <module> from pick import pick File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pick\__init__.py", line 3, in <module> import curses File "c:\users\win10\appdata\local\programs\python\python36-32\lib\curses\__init__.py", line 13, in <module> from _curses import * ModuleNotFoundError: No module named '_curses' PS C:\Users\win10> howmanypeoplearearound Traceback (most recent call last): File "C:\Users\win10\AppData\Local\Programs\Python\Python36-32\Scripts\howmanypeoplearearound-script.py", line 11, in <module> load_entry_point('howmanypeoplearearound==0.3.1', 'console_scripts', 'howmanypeoplearearound')() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 560, in load_entry_point return get_distribution(dist).load_entry_point(group, name) File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2648, in load_entry_point return ep.load() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2302, in load return self.resolve() File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pkg_resources\__init__.py", line 2308, in resolve module = __import__(self.module_name, fromlist=['__name__'], level=0) File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\howmanypeoplearearound\__main__.py", line 11, in <module> from pick import pick File "c:\users\win10\appdata\local\programs\python\python36-32\lib\site-packages\pick\__init__.py", line 3, in <module> import curses File "c:\users\win10\appdata\local\programs\python\python36-32\lib\curses\__init__.py", line 13, in <module> from _curses import * ModuleNotFoundError: No module named '_curses'

What's the problem?

opened by MrAnderson2Neo 2
Multiple MAC addresses for a single rssi in dumped JSON
For one timepoint my dumped JSON file contains the following (redacted), with two MAC addresses separated by a comma, where there is usually a single MAC address:

{"rssi": -77.0, "company": "Apple, Inc.", "mac": "48:43:7c:XX:XX:XX,23:eb:f7:XX:XX:XX"}

This causes a syntax issue in the Javascript generated for analysis that looks like the following, causing the analysis to not display:

var mac48437cXXXXXX,23ebf7XXXXXX = { x: timex, y: [rssi-numbers-omitted], name: '48:43:7c:XX:XX:XX,23:eb:f7:XX:XX:XX', mode: 'lines', type:'scatter' };

Not sure how to replicate it, as I don't have a raw Wireshark dump file matching it. There seems to be the implicit assumption that wireshark will never emit two mac addresses in a single line like that, which should probably be improved on by either dropping the line or splitting the mac address field and duplicating the result. However, given I am not sure why it occurred, I am not sure what the best course of action should be.
opened by ansell 2
Add another method based on BTLE and contact tracing

We can also exploit the contact tracing being added to iOS and Android to answer the question "how many people are around?". Cell phones are transmitting ephemeral IDs with BTLE and we can sniff that with tshark. I have described the method here:

https://xakcop.com/post/how-many-people/

If you think this fits into the project, I can start working on a PR :)

opened by rgerganov 0
Am I missing any step?
Hi @schollz , first things first, thanks for making such a cool project.

I was trying to use this on my mac osx. And here's what I did.

Connected to wifi

Ran

$ brew install wireshark $ brew cask install wireshark-chmodbpf $ sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -z

Installed the pip package, and ran howmanypeoplearearound

I see a very big list of options

I'm not sure which one is my wifi adapter that supports monitor mode. Is there any way to figure that out?

Also, I tried to bruteforce and give it a shot with all the option but everytime the response after scanning is Found no signals, are you sure en0 supports monitor mode?

Can you please help if I'm missing any step?
opened by satwikkansal 3
Add tshark capture filter for probe-req

This change adds a capture filter so that tshark only captures probe requests, ignoring all the other traffic that comes up when a wireless interface is listening in monitor mode.

It uses the following pcap capture filter: "type mgt subtype probe-req" pcap-filter docs: https://www.tcpdump.org/manpages/pcap-filter.7.html

By using a pcap filter, there is less information in the temporary pcap file to parse. Hopefully this slightly optimizes the code.

PS. This is my first pull request! I hope it is helpful, but my sincerest apologies if this is irrelevant or unhelpful. Thanks again for sharing this project and your awesome documentation!

opened by spencerstewart 0