OpenWrt Check who is connected

Posted on October 2, 2012

Tags: hackhard

1 Overview

The below script checks the mac address of who is connected to your OpenWrt whether it is router mode or dumb AP mode.
Maybe a hacker got your SSID password, this will check if the hacker/eavesdropper at one point connected to your device.

#!/bin/sh
tmpfile="tmpfile"
outputfile="eavesdroppers.log"
test -f $outputfile || touch $outputfile

for interface in `iw dev | grep Interface | cut -f 2 -s -d" "`
do
 timestamp=$(date +"%Y%m%d%H%M%S")
 iw dev $interface station dump|grep Station | sed "s/$/ ($timestamp)/" >> $tmpfile
done

while IFS= read -r line
do
 macaddress=$(echo "$line" | cut -d ' ' -f 2)                                      
 if grep -q "$macaddress" $outputfile; then                                        
  sed -i "s/^Station $macaddress.*/$line/" $outputfile
 else                                                                              
  echo "$line" >> $outputfile                                                      
 fi                                                   
done < $tmpfile                              
                                                      
rm $tmpfile

example output on eavesdroppers.log

Station 6x:xx:xx:xx:xx:xx (on wlan0-1) (20240125082124)
Station 6x:xx:xx:xx:xx:xx (on wlan0-1) (20240125082124)
Station 7x:xx:xx:xx:xx:xx (on wlan0-1) (20240125082124)

20240125082124 means (2024-01-25)-(08:21:24) UTC; UTC which is the default timezone set on Openwrt which you can change

1.1 Setup crontab

crontab -e

*/5 * * * * /root/connectedDevices

Some extras on crontab:

# Edit configuration
crontab -e 
 
# Show configuration
crontab -l
 
# Apply changes
service cron restart

# show cron logs
logread -e cron

* * * * * command to execute
- - - - -
| | | | |
| | | | ----- Day of week (0 - 6) (Sunday =0)
| | | ------- Month (1 - 12)
| | --------- Day (1 - 31)
| ----------- Hour (0 - 23)
------------- Minute (0 - 59)