# MAC address randomization tolerant crowd monitoring system using Wi-Fi
packets

Yuyi Cai  The University of TokyoTokyoJapan<EMAIL_ADDRESS>,  Manabu
Tsukada  The University of TokyoJapan<EMAIL_ADDRESS>,  Hideya
Ochiai  The University of TokyoJapan<EMAIL_ADDRESS>and  Hiroshi
Esaki  The University of TokyoJapan<EMAIL_ADDRESS>
(2021)

###### Abstract.

Media access control (MAC) addresses inside Wi-Fi packets can be used for
beneficial activities such as crowdedness estimation, marketing, and hazard
maps. However, the MAC address randomization systems introduced around 2014
make all conventional MAC-address-based crowd monitoring systems count the
same device more than once. Therefore, there is a need to create a new crowd
monitoring system tolerant to MAC address randomization to estimate the number
of devices accurately. In this paper, Vision and TrueSight, two new crowd
monitoring algorithms that estimate the number of devices, are proposed to
prove that MAC-address-based crowd monitoring is still possible. In addition
to probe requests, Vision uses data packets and beacon packets to mitigate the
influence of randomization. Moreover, TrueSight uses sequence numbers and
hierarchical clustering to estimate the number of devices. The experimental
results of this study show that even without installing any special software,
Vision can gather 440 randomly generated MAC addresses into one group and
count only once, and TrueSight can estimate the number of devices with an
accuracy of more than 75% with an acceptable error range of 1.

Crowd monitoring, Wi-Fi, MAC address

††journalyear: 2021††copyright: othergov††conference: Asian Internet
Engineering Conference; December 14–16, 2021; Virtual Event, Japan††booktitle:
Asian Internet Engineering Conference (AINTEC ’21), December 14–16, 2021,
Virtual Event, Japan††price: 15.00††doi: 10.1145/3497777.3498547††isbn:
978-1-4503-9184-9/21/12††ccs: Human and societal aspects of security and
privacy

##  1\. Introduction

Wireless devices have become popular in recent times. According to research
conducted by the Japanese government (Japanese_government, ), more than 80% of
people now have smartphones. Therefore, researchers are trying to analyze
people’s positions and actions by gathering probe requests, a type of Wi-Fi
packet sent by wireless devices (Intro_a, ; Intro_b, ; Intro_c, ; Intro_d, ;
Intro_e, ; Intro_f, ; Intro_g, ; Intro_h, ; Intro_i, ). Probe requests are
used to search for nearby access points (APs) and contain the devices’ media
access control (MAC) addresses.

The basic idea of the original crowd monitoring system was to use frame
control to check whether a Wi-Fi packet was a probe request and gather MAC
addresses in the source address. Researchers considered MAC addresses to be
unique, and the number of people could be counted simply by counting the
number of addresses. However, in 2014, vendors began putting MAC address
randomization systems into their devices to protect users’ privacy.

For example, in 2015, Microsoft added a MAC address randomization system to
Windows 10 (Windows, ). In Windows 10, random addresses are used not only for
probe requests, but also for connecting to a network. To ensure that the
client always uses the same address when connecting to a specific network, the
following formula is used to calculate addresses:

$addr=SHA-256(SSID;macaddr;connId;secret)[:6]$

Here, _SSID_ is the name of the network, _macaddr_ is the original MAC
address, and _connId_ is a parameter that changes if the user removes (and re-
adds) the network from its preferred network list. _secret_ parameter is a
256-bits cryptographic random number generated during system initialization.
This number is unique per interface and remains the same across reboots.

In 2014, there was a commit that added a MAC address randomization system into
the Linux kernel (Linux_a, ). Furthermore, in 2015, wpa_supplicant, a type of
Wi-Fi management software for Linux, also started supporting randomization
from version 2.4 (Linux_b, ).

In 2014, Apple added a MAC address randomization system to iOS 8 (iOS_a, ). In
iOS 8, randomized addresses are only used when they are not connected to any
AP and in sleep mode. In iOS 9, they are also used when not connected to any
AP and in active mode (iOS_b, ). In iOS 14, iPadOS 14, and watchOS 7, Apple
added per network MAC randomization support (iOS_c, ; iOS_d, ).

In 2015, Google added a MAC address randomization system to Android 6.0
(Android_a, ). In Android 6.0, randomized addresses are only used when they
are not connected to any AP. Starting from Android 8.0, Android devices use
randomized MAC addresses when probing for new networks and are not currently
associated with a network. In Android 9, Google added per network MAC
randomization support (Android_b, ).

When these systems are turned on, the MAC addresses inside probe requests
change once every few minutes. This makes malicious users unable to trace
devices using MAC addresses. However, it also makes all conventional MAC-
address-based crowd monitoring systems count the same device more than once.

Thus, this paper presents the design and implementation of a new crowd
monitoring system that is tolerant to MAC address randomization. Vision and
TrueSight were designed and implemented to show that it is still possible to
develop a high-accuracy Wi-Fi packet-based crowd monitoring system.

The remainder of this paper is organized as follows. Section 2 presents an
overview of the related works. Section 3 describes the goal of the study.
Section 4 introduces the key concept of the proposed method. Section 5 shows
how the method actually works. Finally, Section 6 concludes the paper.

##  2\. Related works

Several studies have attempted to reduce the impact of MAC address
randomization. Nakata et al. (Senkou_a, ) proposed a method that uses frame
control, MAC addresses, inter-frame arrival time, sequence numbers, and
received signal strength indicator (RSSI) to estimate the number of devices.

Vanhoef et al. (Senkou_b, ) clustered probe requests based on the fingerprints
of their frame bodies and sequence numbers to estimate the number of devices.
They classified probe requests by fingerprints first and then distinguished
devices by sequence numbers and packet arrival times. However, if a device is
connected to an AP, it will send both probe requests and data packets. This
means that the sequence numbers in probe requests will have a considerable gap
when connected, leading to low estimation accuracy.

Bernardos et al. (Intro_i, ) studied the feasibility of MAC address
randomization for associated devices in real-life conditions. Freudiger
(Senkou_c, ) found that sequence numbers and timing information can be used to
reidentify anonymized probes. Guo et al. (Senkou_d, ) used the inter-frame
arrival time and sequence numbers to detect spoofing on a network with a semi-
active method. Desmond et al. (Senkou_e, ) fingerprinted devices using inter-
frame time analysis alone.

In this study, a new crowd monitoring method is proposed that uses data
packets and beacons to separately consider devices that are already connected
to APs and those not connected to APs. To the best of our knowledge, there are
no studies considering this, and we believe that this will make a more
accurate estimation system.

##  3\. Issues and objectives

In this study, the aim is to classify MAC addresses and estimate the number of
devices accurately.

###  3.1. MAC addresses Classification

Many studies assume that all devices randomize their MAC addresses. However,
when a device is connected to an AP, it can be ensured that its MAC address
will not change randomly. This is because devices and APs use their MAC
addresses to transfer Wi-Fi packets when connected. If they change their MAC
addresses, the connection is terminated immediately, leading to a bad user
experience. In this study, MAC addresses are classified into three groups.

  * •

Those of devices already connected to APs

  * •

Those of devices not connected to APs

  * •

Those of APs

To classify MAC addresses, beacon packets, data packets, and probe requests
are used. They have the following properties, respectively:

Beacon packets:

are sent by APs. They are used to tell the surrounding devices their
existence, and they contain APs’ MAC addresses. Unlike devices, APs do not
change their MAC addresses.

Data packets:

are sent by both APs and devices. They are used to transfer data, and they
contain both devices’ MAC addresses and APs’. These packets are sent only when
the connection is established.

Probe requests:

are sent by devices. They are used to tell the surrounding APs their
existence, and they contain the devices’ MAC addresses.

The type of Wi-Fi packets can be distinguished by checking frame control. It
is necessary to have a system to observe whether a MAC address is randomly
generated.

###  3.2. Accurate estimation

The aim is to find a method to accurately estimate the number of devices. In
the previous section, MAC addresses were classified into three groups. Because
devices do not change their MAC addresses when connected to APs, the number of
MAC addresses can be simply counted to obtain the number of connected devices.
However, this method cannot be used for devices that are not connected to APs.
Therefore, there is a need to find parameters other than MAC addresses to
estimate the number. In this study, hard-to-modify parameters in the frame
body and sequence numbers in sequential control are used to achieve this.

##  4\. Proposed Method

Our proposed method consists of two parts: Vision and TrueSight. Vision
classifies MAC addresses and observes frame bodies in probe requests to
estimate the number of devices. TrueSight observes sequence numbers in
sequential control to count.

###  4.1. Vision

The essential idea behind Vision is to classify the MAC addresses, as shown in
Section 3.1. To do this, the following four elements in Wi-Fi packets must be
checked: frame control, destination address, source address, and frame body. A
flowchart of Vision is shown in figure 1.

Figure 1. Flowchart of Vision Figure 2. Flowchart of TrueSight

The procedure of Vision is shown as follows:

  1. (1)

Classify Wi-Fi packets into three groups, beacon packets, data packets, and
probe requests, by checking frame control.

  2. (2)

Gather MAC addresses from the source address in all beacon packets. These are
the MAC addresses of APs.

  3. (3)

Gather MAC addresses from the destination address and source address in all
data packets and remove those of APs. The remaining MAC addresses belong to
devices that have established connections with APs. The number of MAC
addresses is the number of devices that have established connections with the
APs.

  4. (4)

Gather MAC addresses from the source address in all probe requests and remove
those of devices which have established connections with APs. The remaining
MAC addresses belong to devices that have NOT established connections with the
APs.

  5. (5)

Check the frame bodies of the probe requests sent by devices which have NOT
established connections with APs. Remove the service set identifier (SSID)
parameters and direct sequence spread spectrum (DSSS) parameters, and the
number of the kinds of remainders will be the number of devices that have NOT
established connections with APs.

  6. (6)

Calculate the sum of Step 3 and Step 5. The result is the number of devices
nearby.

In Step 5, it is assumed that the number of unique frame bodies is the number
of devices that have NOT established connections with APs. This is because
frame bodies in probe requests contain many characteristic and hard-to-modify
parameters, and we can use them to distinguish devices.

Table 1 shows the major parameters in frame bodies inside probe requests
(IEEE, ). Of all the parameters, we remove the SSID parameter and DSSS
parameter from frame bodies because we assume they are easy to modify and do
not have characteristics for distinguishing between devices. Then, Vision
check the number of the kinds of remainders to estimate the number of devices
accurately.

Table 1. Major parameters in Frame Body inside probe requests | Tag number
---
(1 octet)
(Tag name) |  | Tag length
---
(1 octet)
| Contents
---
(Length is specified in tag length)
0 |  | Service Set Identifier
---
(SSID) Parameter
Less than 256 | SSID that the device wants to connect with
1 | Supported Rates | 8 or less | Data transfer rates which the device supports
3 |  | Direct Sequence Spread Spectrum
---
(DSSS) Parameter
1 |  | Device’s channel setting
---
when sending the probe request
50 | Extended Supported Rates | Less than 256 |  | If a device supports eight or more data transfer rates,
---
this parameter will be used
221 | Vendor Specific | Less than 256 |  | Vendor specific information
---
(e.g. Who made this device)

###  4.2. TrueSight

Because devices with the same model have a high chance of using the same frame
body, Vision cannot distinguish them properly in Step 5. Thus, another
parameter must be found to distinguish them.

In TrueSight, another element is used in Wi-Fi packets: sequential control. It
contains sequence numbers that show how many Wi-Fi packets a device has sent.
If a device is not connected to any AP, it will not send any packet other than
probe requests, so there is a high probability that its sequence numbers will
be consecutive. For two reasons, the single linkage method, a type of
hierarchical clustering method can be used to estimate the number of devices
accurately.

  * •

Sequence numbers in probe requests sent by the same device have a high chance
to be consecutive or close values.

  * •

Sequence numbers in probe requests sent by different devices have little
chance to be close values

Flowchart of TrueSight is shown in figure 2.

The procedure of TrueSight is shown as follows:

  1. (1)

Follow the procedure of Vision until Step 5.

  2. (2)

For each frame body, gather sequence numbers from sequential control in probe
requests, set a proper threshold and apply single linkage method to them.
Then, the number of clusters is recorded.

  3. (3)

Calculate the total number of clusters. This is the number of devices that
have NOT established connections with APs.

  4. (4)

Calculate the sum of Step 5 in Vision and Step 3 in TrueSight. The result is
the number of devices nearby.

##  5\. Evaluation

###  5.1. Reducing the impact from MAC address randomization

To observe whether Vision can reduce the impact of MAC address randomization
and estimate the number of devices using data packets, beacon packets, and
probe requests, a system was created to capture and analyze packets and check
the difference between the number of MAC addresses not connected to APs and
the number of frame bodies.

We experimented to check if Vision can estimate the number of devices properly
in the laboratory, from September 15, 2020, to September 21, 2020. Figure 3
shows the system used in the experiment. This system consists of two devices,
a Raspberry Pi that can execute Vision, and a Wi-Fi adapter that can turn on
the monitor mode and capture packets.

In the part of the Raspberry Pi, we installed Raspberry Pi OS as operating
system, aircrack-ng and iwconfig for configuring the Wi-Fi adapter, tshark and
tcpdump for capturing Wi-Fi packets, and Python 3.7 for making Vision. To make
Vision, we used datetime, json, os, requests, subprocess, sys, time, watchdog
Python libraries.

For the Wi-Fi adapter, we used the Panda 300Mbps Wireless N USB Adapter Model
PAU05. It has a Ralink RT5372 chipset and can capture 802.11b/g/n (2.4GHz) Wi-
Fi packets.

Figure 3. System made for the experiment

####  5.1.1. Experiment result

Of all the data, the analysis data on September 19, 2020 is shown in figure 4,
which clearly shows the influence of MAC address randomization. The influence
is also detected on other days, but the data on September 19, 2020 is the most
obvious one. From figure 4, it can be seen that there is not much difference
between the number of MAC addresses that only send probe requests and the
number of unique frame bodies, until 10 A.M. However, they differ
significantly after that time. By checking every packet detected, it was found
that there were 440 MAC addresses that sent packets with the same frame body
from 10:40 to 17:10. Since all of our lab’s devices were connected to Wi-Fi
routers during the experiment, there is no doubt that these packets were sent
by outsiders. All 440 MAC addresses were detected only once, and it was
concluded that these MAC addresses were randomly generated by one device, and
Vision succeeded in reducing the impact of MAC address randomization.

Figure 4. Analysis result in Sep. 19th, 2020

###  5.2. Number of devices estimation

In this section, we evaluate how accurately TrueSight can estimate the number
of devices using sequence numbers. Because it is challenging to prepare many
devices using the same model, we implemented a simulator to generate a
realistic dataset with many nodes. Then, we verified how many times TrueSight
estimated the number accurately with the dataset.

####  5.2.1. Dataset preparation

Our simulator generates the dataset as follows:

  1. (1)

Decide the number of the devices (X) and the probe requests sent per device
(Y).

  2. (2)

Choose a random integer from 0 to 4095 and record it. Because sequence numbers
are within the range of 0 to 4095, we cannot choose a number out of its range.

  3. (3)

Add a random integer from 1 to 49 to the last number recorded and record the
result of addition. If the new number is 4096 or more, subtract 4096 from it
first, and then record the result of subtraction. This is because in the
experiment of Vision, there was no device that the maximum gap between any
pair of adjacent sequence numbers was 50 or more.

  4. (4)

Repeat Step 3 for (Y-1) times, respectively. This step aims to imitate a
situation in which a device sends Y probe requests.

  5. (5)

Repeat from Step 2 to Step 4 for (X-1) times. This step aims to imitate the
situation in which X devices send probe requests.

  6. (6)

For all the numbers recorded, set the threshold to 50 and apply single linkage
method, one kind of hierarchical clustering methods.

  7. (7)

The number of the clusters made by Step 6 is the number of devices. This is
because it is guaranteed in Step 3 that the maximum gap between any pair of
adjacent sequence numbers sent by the same device is less than 50.

Table 2. Experiment result when fixing the value of X to 5 and changing the value of Y from 1 to 6 The number of devices (X) |  Probe requests per device (Y) | Estimation result (x) |  Total number of trials (N)
---|---|---|---
1 | 2 | 3 | 4 | 5 | 6
| The number of times that
---
TrueSight estimates there are x devices (n)
5 | 1 |  0 |  4 | 152 | 2,124 | 7,720 | 0 | 10,000
2 |  0 |  13 | 332 | 2,785 | 6,666 | 204 | 10,000
3 |  2 |  29 | 546 | 3,246 | 5,824 | 353 | 10,000
4 |  1 |  66 | 785 | 3,704 | 4,986 | 458 | 10,000
5 |  2 |  102 | 1,066 | 3,922 | 4,352 | 556 | 10,000
6 |  4 |  141 | 1,334 | 4,089 | 3,857 | 575 | 10,000
Table 3. Experiment result when fixing the value of Y to 2 and changing the value of X from 1 to 8 The number of devices (X) |  Probe requests per device (Y) | Estimation result (x) |  Total number of trials (N)
---|---|---|---
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
| The number of times that
---
TrueSight estimates there are x devices (n)
1 | 2 | 9,940 | 60 | - | - | - | - | - | - | - | 10,000
2 | 358 | 9,523 | 119 | - | - | - | - | - | - | 10,000
3 | 25 | 1,023 | 8,786 | 166 | - | - | - | - | - | 10,000
4 | 2 | 121 | 1,912 | 7,781 | 184 | - | - | - | - | 10,000
5 | 0 | 13 | 334 | 2,771 | 6,680 | 202 | - | - | - | 10,000
6 | 0 | 4 | 59 | 766 | 3,500 | 5,470 | 201 | - | - | 10,000
7 | 0 | 0 | 9 | 183 | 1,312 | 3,961 | 4,337 | 198 | - | 10,000
8 | 0 | 0 | 1 | 52 | 457 | 1,957 | 4,115 | 3,247 | 171 | 10,000

Clusters made in Step 6 guarantees that the minimum number is 1, and the
maximum number is $min([\frac{4096}{50}]+1,X+1)$. For the minimum case, this
will occur when all sequence numbers are so close that any pair of adjacent
sequence numbers differs by less than 50. For the maximum case, there are two
possibilities.

  * •

Any pair of adjacent sequence numbers differs by exact 50. In this case, the
number of devices is $[\frac{4096}{50}]+1=81+1=82$.

  * •

Any pair of sequence numbers sent by different devices differs by more than
50, and one of the devices reached 4095 and went back to 0. In this case, this
device is counted twice, and the number of devices will be $X+1$.

To reduce the influence of random number bias, this experiment was carried out
10,000 times, and the number of times TrueSight estimated the number of
devices correctly was recorded.

We used Python 3.7 to implement the simulator, which is made up of numpy,
pandas, scipy, matplotlib, random, and collections Python libraries.

####  5.2.2. Experiment result

Table 2 is the experiment result when fixing the value of X and changing the
value of Y. Bold text indicates that the estimated number of devices matches
with the actual one. From the result, we can say that when the number of probe
requests per device goes up, the accuracy goes down. This is because the more
probe requests are sent, the higher is the probability of sequence numbers
becoming close. Nevertheless, TrueSight can estimate the number of devices to
a certain extent. If an acceptable error range of 1 is set, the accuracy will
be over 80%. To make the estimation more accurate, probe requests must be
captured not only at least once, but also as few as possible. According to the
research by Julien Freudiger (Senkou_d, ), devices send their probe requests
about once a minute. Therefore, to use TrueSight in a practical situation,
setting capture time to one minute is sufficient.

Table 3 is the experiment result when fixing the value of Y and changing the
value of X. From the result, we can say that when the number of devices goes
up, the accuracy goes down. This is because the more devices there are, the
higher the chance of sequence numbers becoming close. Nevertheless, TrueSight
can estimate the number of devices to a certain extent. If we set an
acceptable error range of 1, the accuracy will be more than 75%.

From the two experimental results, we can say that TrueSight is able to
estimate the number of devices. To make the estimation more accurate, we need
to capture probe requests not only at least once, but also as few as possible.

##  6\. Conclusion and Future works

In this study, a new crowd monitoring system was developed that is tolerant to
MAC address randomization. It was found that using characteristic and hard-to-
modify parameters inside probe requests is a good way to reduce the impact of
randomization. Furthermore, our system only counts the number of devices and
does not identify them. This means that if a person turns on the randomization
system, our system can count their device once, but it cannot identify them
because devices with the same model have a high chance of using the same frame
body. Therefore, our system enables users’ privacy and crowd monitoring to
coexist. Moreover, our system does not require users to install special
software. It only requires users to turn on the Wi-Fi function to gather
information. This means that more information can be obtained compared to
other systems. We believe Vision and TrueSight open up new directions of
research on Wi-Fi-packet-based crowd monitoring system.

Our future work will include checking the difference between the estimated
number of devices by Vision and the actual one, and testing TrueSight in
practical situations. It was verified that Vision could estimate the number of
devices while reducing the impact of MAC address randomization. However, the
number of devices was not counted, so it could not be checked whether the
estimated number was accurate. In addition, it was verified that TrueSight
could distinguish devices using the same model, but it was only tested in the
simulated data. Therefore, there is a need to test this method in actual
situations to determine whether it works well.

## References

  * (1) Ministry of Internal Affairs and Communications, Japan. 2020. WHITE PAPER 2020: Information and Communications in Japan. Part 2 Chapter 5 Section 2. Retrieved August 14, 2021 from https://www.soumu.go.jp/johotsusintokei/whitepaper/eng/WP2020/2020-index.html
  * (2) Constantine E Kontokosta and Nicholas Johnson. 2017. Urban phenology: Toward a real-time census of the city using Wi-Fi data. Computers, Environment and Urban Systems, 64:144.153.
  * (3) Emmanuel Touron. 2017. Wifi-VIP: Direct advertising on smartphones Retrieved August 14, 2021 from https://www.lanouvellerepublique.fr/niort/wifi-vip-la-publicite-directe-sur-les-smartphones
  * (4) Camille Allain. 2017. Rennes: WiFi sensors to monitor customers in a city center Retrieved August 14, 2021 from https://www.20minutes.fr/rennes/2011831-20170210-rennes-capteurs-wifi-suivre-clients-centre-ville
  * (5) Yuki Fukuzaki, Masahiro Mochizuki, Kazuya Murao, and Nobuhiko Nishio. 2014. A pedestrian flow analysis system using Wi-Fi packet sensors to a real environment. In Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing: Adjunct Publication (UbiComp ’14 Adjunct). Association for Computing Machinery, New York, NY, USA, 721–730. DOI:https://doi.org/10.1145/2638728.2641312
  * (6) Tetsuro Morimoto, Yusuke Tsujimoto, Shota Shirahama, and Tsuneo Jozen. 2015. Human flow analysis and visualization using Wi-Fi packet sensors. DEIM Forum 2015.
  * (7) Junji Nishida. 2020. Overcoming Challenges to Commercialization of Wi-Fi Packet Sensor: A Traffic Flow Analysis System Born of Industry-Academia-Government Collaboration. Retrieved September 29, 2020 from https://www.ipsj.or.jp/dp/contents/publication/43/S1103-S03.html
  * (8) Tetsuro Morimoto, Shota Shirahama, and Tsuneo Jozen. 2015. Method of pedestrian and traffic flow analysis using Wi-Fi packet sensor. FIT2015, Vol 4, 505-511.
  * (9) A. B. M. Musa and Jakob Eriksson. 2012. Tracking unmodified smartphones using Wi-Fi monitors. In Proceedings of the 10th ACM Conference on Embedded Network Sensor Systems (SenSys ’12). Association for Computing Machinery, New York, NY, USA, 281–294. DOI:https://doi.org/10.1145/2426656.2426685
  * (10) C. J. Bernardos, J. C. Zúńiga and P. O’Hanlon. 2015. Wi-Fi Internet connectivity and privacy: Hiding your tracks on the wireless Internet 2015 IEEE Conference on Standards for Communications and Networking (CSCN), 2015, pp. 193-198, doi: 10.1109/CSCN.2015.7390443.
  * (11) Christian Huitema. 2015. Experience with MAC address randomization on Windows 10. Retrieved September 17, 2020, from https://www.ietf.org/proceedings/93/slides/slides-93-intarea-5.pdf.
  * (12) Emmanuel Grumbach. 2014. iwlwifi: mvm: support random MAC address for scanning. Retrieved September 17, 2020 from https://github.com/torvalds/linux/commit/effd05ac479b80641835f9126bbe93146686c2b8
  * (13) Jouni Malinen. 2015. ChangeLog for wpa_supplicant. Retrieved August 14, 2021 from https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog.
  * (14) Dennis Fisher. 2014. iOS 8 Will Randomize MAC Addresses to Help Stop Tracking. Retrieved September 17, 2020 from https://threatpost.com/ios-8-will-randomize-mac-addresses-to-help-stop-tracking/106527/
  * (15) Katie Skinner and Jason Novak. 2015. Privacy and your app. Apple Worldwide Dev. Conf. (WWDC).
  * (16) Apple. 2020. Use private Wi-Fi addresses in iOS 14, iPadOS 14, and watchOS 7. Retrieved September 17, 2020, from https://support.apple.com/en-us/HT211227.
  * (17) Claus Hetting. 2020. New ’Private Address’ iPhone feature could severely impact the Wi-Fi industry, expert says. Retrieved September 17, 2020 from https://wifinowglobal.com/news-and-blog/new-private-wi-fi-address-iphone-feature-could-severely-impact-the-wi-fi-industry-expert-says/
  * (18) Google. 2015. Android 6.0 Changes. Retrieved August 18, 2021, from
urlhttps://developer.android.com/about/versions/marshmallow/android-6.0-changes.

  * (19) Google. 2020. Privacy: MAC randomization Retrieved September 17, 2020, from https://source.android.google.cn/devices/tech/connect/wifi-mac-randomization.
  * (20) Satoshi Nakata , Azuma Okamoto , Mitsuyoshi Horikawa. 2018. A method for identical device estimation for behavior analysis from Wi-Fi probe requests Retrieved September 17, 2020, from https://ipsj.ixsq.nii.ac.jp/ej/?action=repository_uri&item_id=188868&file_id=1&file_no=1
  * (21) Mathy Vanhoef, Célestin Matte, Mathieu Cunche, Leonardo S. Cardoso, and Frank Piessens. 2016. Why MAC address randomization is insufficient: An analysis of Wi-Fi network discovery mechanisms. In Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security (ASIA CCS ’16). Association for Computing Machinery, New York, NY, USA, 413–424. DOI:https://doi.org/10.1145/2897845.2897883
  * (22) Julien Freudiger. 2015. Short: How Talkative is your mobile device? Experimental Study of Wi-Fi Probe Requests Retrieved December 22, 2020, from https://frdgr.ch/wp-content/uploads/2015/06/Freudiger15.pdf.
  * (23) Fanglu Guo and Tzi-cker Chiueh. 2005. Sequence number-based MAC address spoof detection. In Proceedings of the 8th International Conference on Recent Advances in Intrusion Detection (RAID’05). Springer-Verlag, Berlin, Heidelberg, 309–329. DOI:https://doi.org/10.1007/11663812_16
  * (24) Loh Chin Choong Desmond, Cho Chia Yuan, Tan Chung Pheng, and Ri Seng Lee. 2008. Identifying unique devices through wireless fingerprinting. In Proceedings of the first ACM Conference on Wireless Network Security (WiSec 08). Association for Computing Machinery, New York, NY, USA, 46–55. DOI:https://doi.org/10.1145/1352533.1352542
  * (25) IEEE. 2012. Section 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Retrieved September 17, 2020 from https://legal.vvv.enseirb-matmeca.fr/download/amichel/%5BStandard%20LDPC%5D%20802.11-2012.pdf